Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-02-2024 02:14

General

  • Target

    a52ee5952971f06207484b70ef4db701.exe

  • Size

    534KB

  • MD5

    a52ee5952971f06207484b70ef4db701

  • SHA1

    63b1fa086b655c080ee192568a431b8e6f909596

  • SHA256

    8635fc5fba6998e0d41633828c656dc79898e5a5d3146c943ee35fde37c29946

  • SHA512

    acef8ac8694f0b13a614681ac7163efc11b12a39e4bdbde83f5c3041545d00d6460bc65d5fe995f38e159de8394531f218b4a0e758157acdce4ebce096398f30

  • SSDEEP

    12288:NopMmVHZUm1Cu0/2ufK/lGRgOUqmq9kR6lhKXGSR0mSuraB8B0/pGO:NSM+aWCuMRK/cRgOnmq9g61ura2BMGO

Malware Config

Extracted

Family

cybergate

Version

2.2

Botnet

vítima

C2

kgcd72.no-ip.biz:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a52ee5952971f06207484b70ef4db701.exe
    "C:\Users\Admin\AppData\Local\Temp\a52ee5952971f06207484b70ef4db701.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\a52ee5952971f06207484b70ef4db701.exe
      C:\Users\Admin\AppData\Local\Temp\a52ee5952971f06207484b70ef4db701.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2616
        • C:\Users\Admin\AppData\Local\Temp\a52ee5952971f06207484b70ef4db701.exe
          "C:\Users\Admin\AppData\Local\Temp\a52ee5952971f06207484b70ef4db701.exe"
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2464

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

      Filesize

      137KB

      MD5

      ee485c1b55df0ab0c11a450a33bf6ba7

      SHA1

      ec242c55b842a194a87de635eb33376965e1204c

      SHA256

      da032a05becb822e6d784e614f2c23e0fd174d91b40a95672e66f413d4642fce

      SHA512

      665e94a5b6244275bd8c961930f1ee1eeba98aaed96bf3340ee4113f077b04f855ed858f8f8ac2cadcda1f4b1e98268428f9e44caf502677d86cbe2c19b62d15

    • C:\Users\Admin\AppData\Roaming\logs.dat

      Filesize

      15B

      MD5

      86f3c87caff4d7973404ff22c664505b

      SHA1

      245bc19c345bc8e73645cd35f5af640bc489da19

      SHA256

      e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb

      SHA512

      0940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024

    • memory/1420-61-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-0-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB

    • memory/1420-6-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/1420-7-0x0000000000340000-0x0000000000341000-memory.dmp

      Filesize

      4KB

    • memory/1420-8-0x00000000002F0000-0x00000000002F1000-memory.dmp

      Filesize

      4KB

    • memory/1420-9-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

    • memory/1420-10-0x0000000003590000-0x0000000003591000-memory.dmp

      Filesize

      4KB

    • memory/1420-11-0x0000000000310000-0x0000000000311000-memory.dmp

      Filesize

      4KB

    • memory/1420-12-0x0000000003580000-0x0000000003588000-memory.dmp

      Filesize

      32KB

    • memory/1420-14-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB

    • memory/1420-13-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/1420-15-0x0000000000640000-0x0000000000641000-memory.dmp

      Filesize

      4KB

    • memory/1420-16-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/1420-2-0x0000000000290000-0x00000000002F0000-memory.dmp

      Filesize

      384KB

    • memory/1420-3-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/1420-20-0x0000000000650000-0x0000000000651000-memory.dmp

      Filesize

      4KB

    • memory/1420-22-0x00000000008B0000-0x00000000008B1000-memory.dmp

      Filesize

      4KB

    • memory/1420-66-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-24-0x00000000008A0000-0x00000000008A1000-memory.dmp

      Filesize

      4KB

    • memory/1420-26-0x00000000025D0000-0x00000000025D1000-memory.dmp

      Filesize

      4KB

    • memory/1420-65-0x0000000000290000-0x00000000002F0000-memory.dmp

      Filesize

      384KB

    • memory/1420-28-0x0000000000890000-0x0000000000891000-memory.dmp

      Filesize

      4KB

    • memory/1420-30-0x00000000008D0000-0x00000000008D1000-memory.dmp

      Filesize

      4KB

    • memory/1420-63-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-44-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-32-0x00000000025C0000-0x00000000025C1000-memory.dmp

      Filesize

      4KB

    • memory/1420-34-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/1420-64-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB

    • memory/1420-36-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-38-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-40-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-62-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-5-0x0000000000320000-0x0000000000321000-memory.dmp

      Filesize

      4KB

    • memory/1420-17-0x0000000000360000-0x0000000000361000-memory.dmp

      Filesize

      4KB

    • memory/1420-60-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-46-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-59-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-51-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-48-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-53-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-42-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-50-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-54-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-55-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-56-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-57-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/1420-58-0x00000000035D0000-0x00000000036D0000-memory.dmp

      Filesize

      1024KB

    • memory/2464-341-0x0000000024050000-0x000000002408C000-memory.dmp

      Filesize

      240KB

    • memory/2464-303-0x0000000024050000-0x000000002408C000-memory.dmp

      Filesize

      240KB

    • memory/2464-91-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB

    • memory/2464-88-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/2464-83-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2464-77-0x00000000001B0000-0x00000000001B1000-memory.dmp

      Filesize

      4KB

    • memory/2588-29-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-37-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-67-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-25-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-33-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-21-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-49-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-76-0x00000000002A0000-0x000000000032E000-memory.dmp

      Filesize

      568KB

    • memory/2588-41-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-52-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-18-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-72-0x0000000024010000-0x000000002404C000-memory.dmp

      Filesize

      240KB

    • memory/2588-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2588-310-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2588-68-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB