Analysis

  • max time kernel
    155s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-02-2024 07:43

General

  • Target

    9b24f78266073aed6e00462cb31756e2.exe

  • Size

    457KB

  • MD5

    9b24f78266073aed6e00462cb31756e2

  • SHA1

    603e0d50a9b9464a0a7d70dd0bfb06191918ea6e

  • SHA256

    f8c4d7333771ba91143b8122fe3b8a20b624efc6f2ed9a9899bde7d025518433

  • SHA512

    3fe6b0af07cd3b4661c3d84003c5b6d644727ad2826e273875f9f01aad4bb8bfc7eef7f02087c0dd5aa5d5c64797721dabfddae6ce6bedb83969fc64c6c845fe

  • SSDEEP

    6144:2w9MMg9RwSjLLag2UmGaUtMulLE6raZIMHJJmVLxIyvTTYRP0mCiiggprtQglW+9:f9MblXeU7tMuMHrwLne8d/gopQgYxCm

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

six17.no-ip.biz:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Svchost

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\9b24f78266073aed6e00462cb31756e2.exe
        "C:\Users\Admin\AppData\Local\Temp\9b24f78266073aed6e00462cb31756e2.exe"
        2⤵
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:816
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:2036
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1928
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
              4⤵
                PID:1392
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 776
                  5⤵
                  • Program crash
                  PID:4772
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 992
                  5⤵
                  • Program crash
                  PID:3572
            • C:\Users\Admin\AppData\Local\Temp\9b24f78266073aed6e00462cb31756e2.exe
              "C:\Users\Admin\AppData\Local\Temp\9b24f78266073aed6e00462cb31756e2.exe"
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2276
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                4⤵
                • Modifies Installed Components in the registry
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                PID:3720
                • C:\Windows\SysWOW64\explorer.exe
                  explorer.exe
                  5⤵
                  • Drops file in System32 directory
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5056
                  • C:\Windows\SysWOW64\Svchost\Svchost.exe
                    "C:\Windows\system32\Svchost\Svchost.exe"
                    6⤵
                    • Executes dropped EXE
                    PID:2600
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  5⤵
                    PID:1380
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                    5⤵
                      PID:1012
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 984
                        6⤵
                        • Program crash
                        PID:3480
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 996
                        6⤵
                        • Program crash
                        PID:752
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1392 -ip 1392
              1⤵
                PID:4344
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1012 -ip 1012
                1⤵
                  PID:1420
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1012 -ip 1012
                  1⤵
                    PID:4908
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1392 -ip 1392
                    1⤵
                      PID:3240

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                      Filesize

                      229KB

                      MD5

                      1ef6cae3f52a3803b36ca70da09bee3d

                      SHA1

                      4545b14691be5e189f9436a45d4ddd9dd7fa3609

                      SHA256

                      41c2b2fc8b65d8f67ac2174e31a7052b1657e5bf2ef16ef041d9d6d27cb4a608

                      SHA512

                      fd69aff563f36a2b073ccd41a09fc848a1c01a004ed2fdc626a348fafc6ab84e68c8679607e315e390337295c924dbe80e027c1bb7ea0e3b8ba7666b7e3fcf70

                    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

                      Filesize

                      8B

                      MD5

                      57de41ca5f2125afbb328cff26d62f76

                      SHA1

                      fd1c1f089e645af24426c980adf029a6a574433f

                      SHA256

                      85c3bb6023a714d21e6566bf953bf8443a569d06ba1238bf21731dab034ae074

                      SHA512

                      7a85269db72fba20ad99adfd49c005f08ffddb12ab83f4cd643e71c2165d6427010995345a58cf50f332a317c2e073f68ee32a49621e27922964f6a0b0fcc0b9

                    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

                      Filesize

                      8B

                      MD5

                      86802809ad40cc138137f9e40eea747f

                      SHA1

                      00be3a99db226250cac003c09834904a2c3a425c

                      SHA256

                      e16d7bb319851925827deb672e9c7a284a7ae506e20a29021327cbfc7d826772

                      SHA512

                      d2e569880f02e82c9b68f1d4b0c296c5f7c4779cb06f1d494e3675145ec6e3097cde321a146a8c0b2575b0a3d7df26f8f51a6f3ba9d909fa5cedd923bb18f80e

                    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

                      Filesize

                      8B

                      MD5

                      90dc71465cc2d9453e789de22bcf08a4

                      SHA1

                      c4b0dab9a7683fe1d6e4f1c7c3f2a9ee4e76df7e

                      SHA256

                      bdd3493cb23e7d0be96868476b94ade998680f428be02472a33ff95c6513e719

                      SHA512

                      5130d4a87cfa9416ef63fabd0bb177eb902f43b5fd824cc8cabe2cf3f914063c83b891b00f054aef136caaff68b49545dedf4a55c0420fed80a0b949cad070c3

                    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

                      Filesize

                      8B

                      MD5

                      3c04714c99c44f5d68424afc3fb72b6a

                      SHA1

                      534b283ab9d699a8d8279d2f95b4be40b31d0c85

                      SHA256

                      bc5015d6c6936c58ec03195f8363a55e7e3213b2447527c0343077b2091f40bc

                      SHA512

                      da982931dfb42e11dc033ea3dfe235999028b6e1e2a5ed0313a88286dc65f15132a757f09da3d3b16da27932451284ccec0bb1af965b213d68d3ebdedb635967

                    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

                      Filesize

                      8B

                      MD5

                      9291f27d4086348d95552218419f70ec

                      SHA1

                      43d7af63c04919b01be6ee7493a2771430495b41

                      SHA256

                      f623d4b56bd7674122c6638ee180ac8856f20343ed59cf2fedcfccae674b94a4

                      SHA512

                      7bbc19e21fffc1ec49edd28b73db608973333d69310cecd3aab472164f054d92ddda3603650f05806fd45659ea8c1de1644f916c401ddfd861211db47b69734a

                    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

                      Filesize

                      8B

                      MD5

                      03f15982c3fd3c26e2530a2dc7e185d1

                      SHA1

                      0356c8e5761d5c908f52a0e7dc1206fd2ad257f1

                      SHA256

                      e557cef7ac40e8cea815b89186390f834bbf974455383250246edf706f2037b5

                      SHA512

                      bf99f494c26a7394eeae39f54c8350c93cc14793d32fe6c48dbc2e967c4f177c5abd8075fbf6114ee02bc8c45682a3e615e6c486380d7e1b498ff90d427a574c

                    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

                      Filesize

                      8B

                      MD5

                      1028ba3f7e0ec560dbf7b0bfa1b058c2

                      SHA1

                      8431ca194d2e68000700754d18402cb71b134bc1

                      SHA256

                      b99eb7240b5f760395de61e6bfe9a09bc6640b780da954068b540ebdf964945a

                      SHA512

                      20ce8f67475d558aaf245573d41230d08a20dde2346e3cdceda7ad044fa2b0fd4f9925afb4045535a136d9a65247a9431d31a227e018164aa1cbc3568e046f0f

                    • C:\Users\Admin\AppData\Roaming\logs.dat

                      Filesize

                      15B

                      MD5

                      e21bd9604efe8ee9b59dc7605b927a2a

                      SHA1

                      3240ecc5ee459214344a1baac5c2a74046491104

                      SHA256

                      51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46

                      SHA512

                      42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

                    • C:\Users\Admin\AppData\Roaming\zkHrWvUYWU.exe

                      Filesize

                      457KB

                      MD5

                      9b24f78266073aed6e00462cb31756e2

                      SHA1

                      603e0d50a9b9464a0a7d70dd0bfb06191918ea6e

                      SHA256

                      f8c4d7333771ba91143b8122fe3b8a20b624efc6f2ed9a9899bde7d025518433

                      SHA512

                      3fe6b0af07cd3b4661c3d84003c5b6d644727ad2826e273875f9f01aad4bb8bfc7eef7f02087c0dd5aa5d5c64797721dabfddae6ce6bedb83969fc64c6c845fe

                    • C:\Windows\SysWOW64\Svchost\Svchost.exe

                      Filesize

                      1.1MB

                      MD5

                      d881de17aa8f2e2c08cbb7b265f928f9

                      SHA1

                      08936aebc87decf0af6e8eada191062b5e65ac2a

                      SHA256

                      b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

                      SHA512

                      5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

                    • memory/816-115-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/816-4-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/816-5-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/816-6-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/816-7-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/816-11-0x0000000024010000-0x0000000024072000-memory.dmp

                      Filesize

                      392KB

                    • memory/816-287-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/1012-360-0x0000000024160000-0x00000000241C2000-memory.dmp

                      Filesize

                      392KB

                    • memory/1012-323-0x0000000024160000-0x00000000241C2000-memory.dmp

                      Filesize

                      392KB

                    • memory/1392-285-0x0000000024160000-0x00000000241C2000-memory.dmp

                      Filesize

                      392KB

                    • memory/1392-361-0x0000000024160000-0x00000000241C2000-memory.dmp

                      Filesize

                      392KB

                    • memory/2036-15-0x0000000000840000-0x0000000000841000-memory.dmp

                      Filesize

                      4KB

                    • memory/2036-201-0x0000000024080000-0x00000000240E2000-memory.dmp

                      Filesize

                      392KB

                    • memory/2036-87-0x0000000024080000-0x00000000240E2000-memory.dmp

                      Filesize

                      392KB

                    • memory/2036-16-0x0000000000900000-0x0000000000901000-memory.dmp

                      Filesize

                      4KB

                    • memory/2276-118-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/2276-121-0x00000000012E0000-0x00000000012F0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2276-29-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/2276-24-0x00000000012E0000-0x00000000012F0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2276-18-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/3312-2-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/3312-48-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/3312-0-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/3312-1-0x0000000001600000-0x0000000001610000-memory.dmp

                      Filesize

                      64KB

                    • memory/3312-86-0x0000000001600000-0x0000000001610000-memory.dmp

                      Filesize

                      64KB

                    • memory/3720-324-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/3720-30-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/3720-123-0x0000000000400000-0x000000000044E000-memory.dmp

                      Filesize

                      312KB

                    • memory/5056-218-0x0000000024010000-0x0000000024072000-memory.dmp

                      Filesize

                      392KB

                    • memory/5056-169-0x0000000024010000-0x0000000024072000-memory.dmp

                      Filesize

                      392KB