Analysis

  • max time kernel
    145s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-04-2024 01:54

General

  • Target

    f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe

  • Size

    264KB

  • MD5

    f93f78e3921c97c6ad8f110314aa7113

  • SHA1

    6615426cf2097fac0e9fddc6db2a9a08661c56a5

  • SHA256

    0234c2bba8c75e3095beb312eaac7391069ad19ec57a4a859995449bba922c2f

  • SHA512

    dc3dde113a156a2071827a24ee44163cebf359c2421744265957f8404723aeed91a716f42ac44fdb30ed0c7d15b8afd64b4d2af9d58a2ed11d13e80551de712e

  • SSDEEP

    6144:X+/R02x4rGywlwjEAtqxp4FPKn5K3lV3uvj/JNxWpHlZ72HvRWJ:o0brGnDA8RnQ3lVeDJNIpHlZwvRWJ

Malware Config

Extracted

Family

cybergate

Version

2.2

Botnet

vítima

C2

kgcd72.no-ip.biz:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    flash

  • install_file

    player.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1800
        • C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\f93f78e3921c97c6ad8f110314aa7113_JaffaCakes118.exe"
          3⤵
          • Drops file in Windows directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1684

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    3
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    3
    T1547.001

    Defense Evasion

    Modify Registry

    3
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
      Filesize

      137KB

      MD5

      a20c634bf05e2f5f7be878ba989209cb

      SHA1

      b748ac5ca00d82c47ae134416823ff2a1c487bd0

      SHA256

      a0fd16430d7ca5f8908dba9ae6d3433c33e49cf3f45afc327ba34995338e5518

      SHA512

      b338a65fae2f18b2ac38a5aeaf2d894e0fc9ee429517bb7fd517c2d34c1c1d3a4f088f50a36d59009ad310c943b83dd7d92d02c990f0c2fc14397e366af697bc

    • C:\Users\Admin\AppData\Roaming\logs.dat
      Filesize

      15B

      MD5

      86f3c87caff4d7973404ff22c664505b

      SHA1

      245bc19c345bc8e73645cd35f5af640bc489da19

      SHA256

      e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb

      SHA512

      0940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024

    • C:\Windows\flash\player.exe
      Filesize

      264KB

      MD5

      f93f78e3921c97c6ad8f110314aa7113

      SHA1

      6615426cf2097fac0e9fddc6db2a9a08661c56a5

      SHA256

      0234c2bba8c75e3095beb312eaac7391069ad19ec57a4a859995449bba922c2f

      SHA512

      dc3dde113a156a2071827a24ee44163cebf359c2421744265957f8404723aeed91a716f42ac44fdb30ed0c7d15b8afd64b4d2af9d58a2ed11d13e80551de712e

    • memory/1684-40957-0x0000000024050000-0x000000002408C000-memory.dmp
      Filesize

      240KB

    • memory/1684-40917-0x0000000024050000-0x000000002408C000-memory.dmp
      Filesize

      240KB

    • memory/1684-40711-0x00000000003A0000-0x00000000003A1000-memory.dmp
      Filesize

      4KB

    • memory/1684-40698-0x00000000002D0000-0x00000000002D1000-memory.dmp
      Filesize

      4KB

    • memory/2300-40676-0x0000000000400000-0x0000000000439000-memory.dmp
      Filesize

      228KB

    • memory/2300-40921-0x0000000000400000-0x0000000000439000-memory.dmp
      Filesize

      228KB

    • memory/2300-40682-0x0000000000320000-0x000000000032F000-memory.dmp
      Filesize

      60KB

    • memory/2744-63-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-59-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-19-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-17-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-15-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-3-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-1-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-40655-0x00000000002D0000-0x00000000002DF000-memory.dmp
      Filesize

      60KB

    • memory/2744-57-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-53-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-61-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-0-0x0000000000400000-0x000000000040F000-memory.dmp
      Filesize

      60KB

    • memory/2744-55-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-21-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-23-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-25-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-7-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB

    • memory/2744-5-0x0000000000410000-0x0000000000453000-memory.dmp
      Filesize

      268KB