Overview

overview

10

Static

static

3

ff58273d54...18.exe

windows7-x64

10

ff58273d54...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    9s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-04-2024 13:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff58273d54ebb2be052348727978f105_JaffaCakes118.exe

  • Size

    557KB

  • MD5

    ff58273d54ebb2be052348727978f105

  • SHA1

    60e481e749494fc56c97f5b02daf75456fa5514f

  • SHA256

    eadfd15b75f3fcf3746a45a10da8be9d3956efef3207fe72ca3327ab8c1d39e3

  • SHA512

    4a38cc151068cde172ac4f1d74190203d983da8fe0fbd565c02ad8e9fe518aa53375cded0083e66e57ee1fbf8ee5f84175952d8fcaba0caeaee08d272a686951

  • SSDEEP

    12288:evCnyQjPtB9yYmQVIJ15QNpTBd47GLRMTb7:l7jPtOY2JYXd474mf7

Score
10/10
cybergateasasasapersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

asasasa

C2

secretos505.no-ip.org:81

Mutex

DO7T5F16PEUP86

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    takshot.exe

  • install_dir

    win32

  • install_file

    Win32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    12345

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3332
      • C:\Users\Admin\AppData\Local\Temp\ff58273d54ebb2be052348727978f105_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ff58273d54ebb2be052348727978f105_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4820
        • C:\Users\Admin\AppData\Local\Temp\ff58273d54ebb2be052348727978f105_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\ff58273d54ebb2be052348727978f105_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Checks computer location settings
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4776
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4912
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3984
            • C:\Users\Admin\AppData\Local\Temp\ff58273d54ebb2be052348727978f105_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\ff58273d54ebb2be052348727978f105_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:4876
            • C:\Windows\win32\Win32.exe
              "C:\Windows\win32\Win32.exe"
              4⤵
              • Executes dropped EXE
              PID:3144

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
        Filesize

        224KB

        MD5

        e391fb33092f3e16998bb69df2b405fb

        SHA1

        a11542e0d8ac45fa0cbeb212445660cb337d0f4f

        SHA256

        3256da6ebd016f7e694ede90c5dd65e3b7725efc32387ec2a91928b720109da1

        SHA512

        6e9adfc6f7fac484f2f4b3dedf95c8513ad6b492969f0bf4a86620db70cb27c31542a97d022a52d5914fe4cbc8ba5739645bbe9d324fa26f6d4a3545d940fdbd

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Adminlog.dat
        Filesize

        15B

        MD5

        bf3dba41023802cf6d3f8c5fd683a0c7

        SHA1

        466530987a347b68ef28faad238d7b50db8656a5

        SHA256

        4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

        SHA512

        fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

        Download Submit
      • C:\Windows\win32\Win32.exe
        Filesize

        557KB

        MD5

        ff58273d54ebb2be052348727978f105

        SHA1

        60e481e749494fc56c97f5b02daf75456fa5514f

        SHA256

        eadfd15b75f3fcf3746a45a10da8be9d3956efef3207fe72ca3327ab8c1d39e3

        SHA512

        4a38cc151068cde172ac4f1d74190203d983da8fe0fbd565c02ad8e9fe518aa53375cded0083e66e57ee1fbf8ee5f84175952d8fcaba0caeaee08d272a686951

        Download Submit
      • memory/4776-5-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

        Download
      • memory/4776-9-0x0000000010410000-0x0000000010475000-memory.dmp
        Filesize

        404KB

        Download
      • memory/4776-69-0x0000000010480000-0x00000000104E5000-memory.dmp
        Filesize

        404KB

        Download
      • memory/4776-2-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

        Download
      • memory/4776-4-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

        Download
      • memory/4776-91-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

        Download
      • memory/4776-3-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

        Download
      • memory/4776-163-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

        Download
      • memory/4876-144-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

        Download
      • memory/4912-13-0x0000000000D60000-0x0000000000D61000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4912-14-0x0000000001020000-0x0000000001021000-memory.dmp
        Filesize

        4KB

        Download
      • memory/4912-74-0x0000000010480000-0x00000000104E5000-memory.dmp
        Filesize

        404KB

        Download