Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    22-06-2024 01:47

General

  • Target

    00bb4602d3b7d7772de0c35311c99586_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    00bb4602d3b7d7772de0c35311c99586

  • SHA1

    94b92465db3156104623dd0198b361f616de8a10

  • SHA256

    ce28ed6f32da69838e765722bff342fcbde5b2350399c893db80eec00ee1d9c8

  • SHA512

    347304ad0b0bc3c8873df73a20d998784dd08e50865375a79b3bdc46fec4cef4307be1cca1bfaf648a5c1e2b82b137d35ce97bb0efde68c6936b32af784499ad

  • SSDEEP

    24576:LUYMtnES0/6JyV9cCRbtaoD3ztOyvN6G0rCJN:LrMeJsyVf3LzdVt0rK

Malware Config

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00bb4602d3b7d7772de0c35311c99586_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\00bb4602d3b7d7772de0c35311c99586_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 160
      2⤵
      • Program crash
      PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2160-0-0x0000000000400000-0x0000000000504000-memory.dmp
    Filesize

    1.0MB

  • memory/2160-1-0x0000000000400000-0x0000000000504000-memory.dmp
    Filesize

    1.0MB