Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-02-2024 19:30

General

  • Target

    a292a15e18ebb542a36509dc86e2b294.exe

  • Size

    1.4MB

  • MD5

    a292a15e18ebb542a36509dc86e2b294

  • SHA1

    16c5660c4f03e02aec399821568d0178d5067726

  • SHA256

    8462d608d04b29277d73c4df5bacc1baddc852ffabded6e70535ac89f8a5c620

  • SHA512

    f7499eb377af0b36f145dcb2b41c424048d0f3b2ca8804d65a82301d9e0b1f81fa516d21b9f2550dbabd16646209f8632685dd99fcce503d6fb60483dc167b5d

  • SSDEEP

    24576:jNg3tLAZjVrxCAgjMXV317ma+1mSNX0vuIS2PFe+V9uQ/PT85op6VaF3lmH5hjzU:jNI8j9cjMX517m31rXyuISwFPJr86prh

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

undernet-hacker.no-ip.info:80

undernet-hacker.no-ip.info:79

undernet-hacker.no-ip.info:78

undernet-hacker.no-ip.info:286

Mutex

***Microsoft***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    taskmgr.exe

  • install_dir

    Microsoft

  • install_file

    Windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    bruno00

  • regkey_hkcu

    Windows

  • regkey_hklm

    Windows

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a292a15e18ebb542a36509dc86e2b294.exe
    "C:\Users\Admin\AppData\Local\Temp\a292a15e18ebb542a36509dc86e2b294.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2152-1-0x00000000006C0000-0x00000000007A6000-memory.dmp

    Filesize

    920KB

  • memory/2152-0-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2152-2-0x0000000000400000-0x00000000006B2000-memory.dmp

    Filesize

    2.7MB

  • memory/2152-8-0x00000000043E0000-0x00000000043E1000-memory.dmp

    Filesize

    4KB

  • memory/2152-7-0x00000000043B0000-0x00000000043B1000-memory.dmp

    Filesize

    4KB

  • memory/2152-9-0x0000000004390000-0x0000000004391000-memory.dmp

    Filesize

    4KB

  • memory/2152-6-0x00000000043C0000-0x00000000043C1000-memory.dmp

    Filesize

    4KB

  • memory/2152-5-0x0000000002280000-0x0000000002281000-memory.dmp

    Filesize

    4KB

  • memory/2152-4-0x0000000004360000-0x0000000004361000-memory.dmp

    Filesize

    4KB

  • memory/2152-3-0x0000000004140000-0x0000000004141000-memory.dmp

    Filesize

    4KB

  • memory/2152-13-0x00000000043A0000-0x00000000043A1000-memory.dmp

    Filesize

    4KB

  • memory/2152-15-0x0000000000400000-0x00000000006B2000-memory.dmp

    Filesize

    2.7MB

  • memory/2152-14-0x0000000004350000-0x0000000004351000-memory.dmp

    Filesize

    4KB

  • memory/2152-16-0x0000000004350000-0x0000000004351000-memory.dmp

    Filesize

    4KB