Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2024 03:18

General

  • Target

    010cce1d89cd52387d838e049492538a_JaffaCakes118.exe

  • Size

    218KB

  • MD5

    010cce1d89cd52387d838e049492538a

  • SHA1

    b6742db0d25ba2de4b1d1589f652f8e4ce72b4ea

  • SHA256

    19376c5f5870627e45e70a3e273a3d1d2560b360f0ad673d72ff1ec079ef0a30

  • SHA512

    1c8ca69b9787be86fee226c17daf4cbef506d354ec3442abc3d04e50ef2fde83fb57e2ca5f75826e6eaa0e14d4b09785b087d09bb7121fcb5cff85707b654ada

  • SSDEEP

    6144:LVaT2+MBUnBhscAjrzGF7D68aqHp+6tbeXdQJL9Nw:xadMBI/lRDaA9tSIRNw

Malware Config

Extracted

Family

cybergate

Version

2.2.3

Botnet

vctima

C2

almoomia10.no-ip.biz:80

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    dasbin

  • install_file

    mari.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    6458713

  • regkey_hkcu

    ass2

  • regkey_hklm

    ass1

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2972
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:4492
          • C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\010cce1d89cd52387d838e049492538a_JaffaCakes118.exe"
            4⤵
            • Drops file in System32 directory
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3340

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Active Setup

    1
    T1547.014

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Active Setup

    1
    T1547.014

    Defense Evasion

    Modify Registry

    3
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
      Filesize

      141KB

      MD5

      aee0e396c6c3c87f10c1c5e903a0802e

      SHA1

      bcf6288675f93a1eb3ec195c7427070b5e351f07

      SHA256

      78375ac626c25963f98cf1946e9815921be9297d7b0d6b5cc7e3dbe8cdf831f4

      SHA512

      dde244b38ee8af785bfc6f9b19c5aab9f0eccf5928e454a09d65a6c1bc54d2aa9b4616ac5c89181bd83773886085c601a21af0bf8b39a760bd3f7b8aece48ce9

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
      Filesize

      8B

      MD5

      d0fbd79bfa46fc85267f2676c1f56633

      SHA1

      84d307cf6a3bc24903e1b2e4a11e3180f4d6ade0

      SHA256

      c64d9c02de6de694507a11dbe99db1dbcd04473eebdbcf81e4dd22fa12401caa

      SHA512

      2185d6560bba3cc2ea41b3e2dde4e0e241c3bcd65be9b9608a6ce6a3625cc63824fb4e1202895c89cb2d3c12076c525fcca85a4970ee997a5da4832678c29b58

    • C:\Users\Admin\AppData\Roaming\logs.dat
      Filesize

      15B

      MD5

      86f3c87caff4d7973404ff22c664505b

      SHA1

      245bc19c345bc8e73645cd35f5af640bc489da19

      SHA256

      e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb

      SHA512

      0940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024

    • C:\Windows\SysWOW64\dasbin\mari.exe
      Filesize

      218KB

      MD5

      010cce1d89cd52387d838e049492538a

      SHA1

      b6742db0d25ba2de4b1d1589f652f8e4ce72b4ea

      SHA256

      19376c5f5870627e45e70a3e273a3d1d2560b360f0ad673d72ff1ec079ef0a30

      SHA512

      1c8ca69b9787be86fee226c17daf4cbef506d354ec3442abc3d04e50ef2fde83fb57e2ca5f75826e6eaa0e14d4b09785b087d09bb7121fcb5cff85707b654ada

    • memory/2972-7-0x0000000000400000-0x000000000043F000-memory.dmp
      Filesize

      252KB

    • memory/2972-70-0x00000000008A0000-0x00000000008DE000-memory.dmp
      Filesize

      248KB

    • memory/2972-2-0x0000000000400000-0x000000000043F000-memory.dmp
      Filesize

      252KB

    • memory/2972-5-0x0000000000400000-0x000000000043F000-memory.dmp
      Filesize

      252KB

    • memory/2972-16-0x0000000024050000-0x000000002408E000-memory.dmp
      Filesize

      248KB

    • memory/2972-125-0x0000000000400000-0x000000000043F000-memory.dmp
      Filesize

      252KB

    • memory/2972-8-0x0000000000400000-0x000000000043F000-memory.dmp
      Filesize

      252KB

    • memory/2972-11-0x0000000024010000-0x000000002404E000-memory.dmp
      Filesize

      248KB

    • memory/2972-15-0x0000000000400000-0x000000000043F000-memory.dmp
      Filesize

      252KB

    • memory/2972-61-0x0000000024050000-0x000000002408E000-memory.dmp
      Filesize

      248KB

    • memory/2972-1-0x0000000000400000-0x000000000043F000-memory.dmp
      Filesize

      252KB

    • memory/2972-0-0x0000000000400000-0x000000000043F000-memory.dmp
      Filesize

      252KB

    • memory/4228-6-0x0000000000400000-0x000000000043D000-memory.dmp
      Filesize

      244KB

    • memory/4492-64-0x0000000003AE0000-0x0000000003AE1000-memory.dmp
      Filesize

      4KB

    • memory/4492-68-0x0000000024050000-0x000000002408E000-memory.dmp
      Filesize

      248KB

    • memory/4492-65-0x0000000024050000-0x000000002408E000-memory.dmp
      Filesize

      248KB

    • memory/4492-17-0x0000000001310000-0x0000000001311000-memory.dmp
      Filesize

      4KB

    • memory/4492-18-0x00000000013D0000-0x00000000013D1000-memory.dmp
      Filesize

      4KB