Analysis

  • max time kernel
    150s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2023, 11:10

General

  • Target

    aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe

  • Size

    597KB

  • MD5

    a7cf3a9a2608091aeefd3b028f6c8212

  • SHA1

    773f38e2676c57f2b70754aca0a0ddc0e3b3861f

  • SHA256

    aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745

  • SHA512

    22ab8c3f06bfc3ce4cb1c886b9fec218cc8a6245c6adc96ac16308a5bdb3ae02fc7ab5437a87182b3d00074009219f1814b84e4b3b1b2a6ebfa38000bfb3185f

  • SSDEEP

    12288:p7JRNRtfWDuCIe0A/RDwtOkNglXrOS8OmARzFmInZkUb/G//MM3trzpHw0:ptO6+f/5wtmxrOS8zOZkWuB

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

1

C2

hobolicker.servebeer.com:569

Mutex

Y0108IAWI27L0C

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    giblets1880

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Executes dropped EXE 5 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe
    "C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\java.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\java2.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Roaming\java2.bat" "
          4⤵
          • Drops startup file
          PID:1608
    • C:\Windows\Temp\svchost.exe
      C:\Windows\Temp\svchost.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1328
        • C:\Windows\Temp\svchost.exe
          "C:\Windows\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1516
      • C:\Windows\Temp\svchost.exe
        C:\Windows\Temp\svchost.exe
        2⤵
        • Executes dropped EXE
        PID:1344
      • C:\Windows\Temp\svchost.exe
        C:\Windows\Temp\svchost.exe
        2⤵
        • Executes dropped EXE
        PID:1572
      • C:\Windows\Temp\svchost.exe
        C:\Windows\Temp\svchost.exe
        2⤵
        • Executes dropped EXE
        PID:368

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

      Filesize

      236KB

      MD5

      8e88f7ca977aab4c4957850affaf69dc

      SHA1

      7ce0df92852fda4c1884efda6d839d12d78f2181

      SHA256

      85067be04b7974987b68c75d5bec4f1b87f03212b89ac3e2a5d1348d7586c670

      SHA512

      624e53041bd1dca5e3496cb269004f63d3ba895b96eec4bf56d55370bd1288f7f712d90b3457cf8fe26f390441ce8c1af9612edba2cb3eba6bfdbe0918609c44

    • C:\Users\Admin\AppData\Roaming\invs.vbs

      Filesize

      78B

      MD5

      c578d9653b22800c3eb6b6a51219bbb8

      SHA1

      a97aa251901bbe179a48dbc7a0c1872e163b1f2d

      SHA256

      20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

      SHA512

      3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

    • C:\Users\Admin\AppData\Roaming\java.bat

      Filesize

      53B

      MD5

      1896de26a454df8628034ca3e0649905

      SHA1

      76b98d95a85d043539706b89194c46cf14464abe

      SHA256

      d85e713743c7e622166fb0f79478de5eabd53d3fe92bd2011ab441bc85ef2208

      SHA512

      ef69dacd7e717dff05f8a70c5b9a94011f2df3201cc41d5f8cc030f350b069dc090c5b0d3d0bd19098a187977a82d570e1ee153849f609a65889ba789da953d2

    • C:\Users\Admin\AppData\Roaming\java2.bat

      Filesize

      156B

      MD5

      6e11326aa89037c32d94aac927174738

      SHA1

      002281bc47dab009f00ed9bfa898cb58605ac0c4

      SHA256

      fe4445a81e9eca7f954f0a5233bed798ba654d39503776d410b071a768147808

      SHA512

      423c6adb6d3cab2601607b813b1e6d48f60c7b3464f857d8e8f40b2445de1b7b66bc469c6367bd437c7896aec49ba87ab917ad919deeb713f1150c7764df21cf

    • C:\Users\Admin\AppData\Roaming\msvcnp .exe

      Filesize

      597KB

      MD5

      a7cf3a9a2608091aeefd3b028f6c8212

      SHA1

      773f38e2676c57f2b70754aca0a0ddc0e3b3861f

      SHA256

      aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745

      SHA512

      22ab8c3f06bfc3ce4cb1c886b9fec218cc8a6245c6adc96ac16308a5bdb3ae02fc7ab5437a87182b3d00074009219f1814b84e4b3b1b2a6ebfa38000bfb3185f

    • C:\Users\Admin\AppData\Roaming\rundll32-.txt

      Filesize

      597KB

      MD5

      a7cf3a9a2608091aeefd3b028f6c8212

      SHA1

      773f38e2676c57f2b70754aca0a0ddc0e3b3861f

      SHA256

      aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745

      SHA512

      22ab8c3f06bfc3ce4cb1c886b9fec218cc8a6245c6adc96ac16308a5bdb3ae02fc7ab5437a87182b3d00074009219f1814b84e4b3b1b2a6ebfa38000bfb3185f

    • C:\Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • C:\Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • C:\Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • C:\Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • C:\Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • C:\Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • \Windows\Temp\svchost.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • memory/1516-128-0x0000000010490000-0x0000000010502000-memory.dmp

      Filesize

      456KB

    • memory/1516-135-0x0000000010490000-0x0000000010502000-memory.dmp

      Filesize

      456KB

    • memory/1516-130-0x0000000010490000-0x0000000010502000-memory.dmp

      Filesize

      456KB

    • memory/1516-126-0x0000000010490000-0x0000000010502000-memory.dmp

      Filesize

      456KB

    • memory/1756-132-0x00000000749B0000-0x0000000074F5B000-memory.dmp

      Filesize

      5.7MB

    • memory/1756-134-0x00000000749B0000-0x0000000074F5B000-memory.dmp

      Filesize

      5.7MB

    • memory/1756-54-0x0000000076171000-0x0000000076173000-memory.dmp

      Filesize

      8KB

    • memory/1756-55-0x00000000749B0000-0x0000000074F5B000-memory.dmp

      Filesize

      5.7MB

    • memory/2008-72-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-98-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-100-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-102-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-104-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-108-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-106-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-110-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-111-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-113-0x0000000010410000-0x0000000010482000-memory.dmp

      Filesize

      456KB

    • memory/2008-96-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-94-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-92-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-76-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-78-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-123-0x0000000010490000-0x0000000010502000-memory.dmp

      Filesize

      456KB

    • memory/2008-70-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-69-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-68-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-131-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-67-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-66-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-64-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

    • memory/2008-63-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB