Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11-09-2024 20:29

General

  • Target

    db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    db295321c287aceba94bdaa3b2141cb6

  • SHA1

    18aeb11cf5e1d3579fb30862c56a70ace4b7ac45

  • SHA256

    5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3

  • SHA512

    07720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaGPoPqZyONw4jDVslGWvn0GZ85:mJZoQrbTFZY1ia6d1jDyIYn0GZ85

Malware Config

Extracted

Family

cybergate

Version

v1.01.8

Botnet

remote

C2

freeforfree.ddns.net:999

Mutex

upgrade

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    updated.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    FUNCIOANL EXECUTOU

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1252
      • C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2776
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:2508
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Loads dropped DLL
            • Drops desktop.ini file(s)
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2284
            • C:\Windows\SysWOW64\install\updated.exe
              "C:\Windows\system32\install\updated.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1472
              • C:\Windows\SysWOW64\install\updated.exe
                "C:\Windows\SysWOW64\install\updated.exe"
                6⤵
                • Executes dropped EXE
                PID:2600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

      Filesize

      221KB

      MD5

      0746e5babcefa3b07c8f315a42fcdabb

      SHA1

      8f6f15241bfe1d9f15f0f86af11e25f92d144cc0

      SHA256

      7ead0f724ec2fd62f1ed50b0856fda637fa8ef2ee5de8eb33fef1df58faa3806

      SHA512

      8025ba2a59c712dadfe932bfcce90a1a111e6b72a7346d0e114001afadb8e85d9374a857be3897f785d4a0dc5967fb2ea2ab675d46a69e79263758b8ee44ea8f

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      f9b2e83dec24981e83f8d65db8a9b102

      SHA1

      bf460acba8f7620c29481a97ba43e40a9f50d73a

      SHA256

      9751be5ac7a25caaa41431423f90e2eecc71112329a14fc93a9294125a1b6328

      SHA512

      a12c27f22de3ace3d88d5f6e9f369c9c55bd4ab37dedf39d81a4ae4e86b85dbca0ae2519027077e6b4042ed64c5e7ee394687bc57ac173162cc28e02e15b83d1

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      54e01f5251006d8fcd218f5994fc2e5b

      SHA1

      22f7fdb8fd52271ae806456425118fea50fc5203

      SHA256

      8cc854dfd9f5a483337e56a3ffba6eda2c1264aacd38c1d2373a62056c2f635f

      SHA512

      d11ae1d34a948e2585a7c49e096d141dbe4d8fabbe1237627b623c9c487792844c8bf8d0e2b119079f13e57e301347091119b7e4dfcc5847daa79be4ca26b82c

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      32ee19a3f1036e7bcaeff1752e8425f9

      SHA1

      86850e6558a130bcc44723c378a02c1ee1410b3e

      SHA256

      e14d39fd72edac8c0323978d2119514c3dbbf8e318daa968e106bda638c1aa52

      SHA512

      2a5227ffb6c14c6c2a1c1a9e8f88f258c246d62ce44f7e1d65f5ca578423d73d7fbfa0a487f4b2f9d5da7a66ac4e10b19e383ea29c18557be403e5059abe56df

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      7bc3ad4c6f6aea06392573002643965a

      SHA1

      1e8cc6ac9c639388a57a77348e9fe90f3be59a54

      SHA256

      c7634d92c98d6bee72490e27a8223e434c0c2d3e064412de41a2684c58e9b77d

      SHA512

      18f5e7c192e3d1840b5c884e496b45162da04d28b0dab38773add46c0146390a21357e9ea79742e7b877b698c6ff6a8455b302396e575953c017e86723f401d1

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      1d52b9ecc0f3bfa8714abe02b0c7ce58

      SHA1

      d725cd89b55f93a8673b2b7f8d1956896aa9b4eb

      SHA256

      cadd44aa778b9113a0c30162a7ecf37e4a43400ee09ef455f702bd89a4dc364b

      SHA512

      19effaade0933116a47a7314c30b051409e3e31280d6f48d9e971dd227251cd0aca6c1b30711d0ce339043f62180e3a6676828d359b04722e0da4bf5000b9715

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      e8eeaa3559a37812cdeea64c466c58f5

      SHA1

      d8f99a25f5f4d7d726d00896da4d57103dbb2996

      SHA256

      ace7444032ce78d7d9ee9a00c550e682bc41358fafb76783deac815cca9fe4be

      SHA512

      f39d962d524a36ddae4f90fe20e858ae934ae0762da6382766c38f6a874f8042a641c205579e52c303003261ff831fd72a0967bb02596b28071043417864d293

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      78f43182e71d2101b83a424fe77497e1

      SHA1

      e94432409bf5c45dff7a643ff29c918a8b1aec8b

      SHA256

      4c0be6f09f426cc2e3506353301349f37d5c4aafaeb9ea3df3a03b7d41d55629

      SHA512

      d9c93439ea5b5be3afef4106ce3b1a5c3c526bcb85eb1910de5f2896900bdcc2c1396bbb2db21a286409d22c9ba5610cc7c625fac56faa16d62d451b6094212b

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      83dab600735c9b58b3998e219636c16a

      SHA1

      9414cfb84797ec2fc7fa892fe8f150585884da94

      SHA256

      025085ecca5a15c025c3c56eaa709faebb947ac4fc5e8523ce9ae6980cd07d60

      SHA512

      f289c491a7b198957b4cb5449dfe564f6532d1d4a6401990a12a00d543bbcf8fd0a2cd5b8bcceb4c18ae091ae00383255be03990fce21b84c7d2a924d3850b19

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      d6b32c8a822dca415a95375fcd89d049

      SHA1

      c2479022cd43b9167eeebfd5a1fd46b61c9edab4

      SHA256

      aae604d9281f80bfbf0b0dd7ff929f216bc82ec6eaf40ece1a15a68773ac6019

      SHA512

      77f9fa7ff70b0bb410f7617f080690e5a4509a462da4494230a275e0fac040399e3df504ed0f6fc5de35f499e65230555ff75b0a78fb2ad1d4f17ad788f1afb4

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      fb7b221dc8ae3214e17c604682446d4d

      SHA1

      f15f2021cd0d146a198cf8b198dea2b48e83b75c

      SHA256

      575cd6e7f144d9edd1bfed552eec49c35dc4b3a745f109789c0f5228d7bfcf96

      SHA512

      d266affa38bd020c18bd63d84a5815b5db75b3826238f5d19a8e2a805369a402b9b5e8ebb13c8ddbfd7fdfc68eb46de47b6d62cd70b64cbfbfac0c46c919807b

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      1c6afe8378053ce62efef55990a7c28d

      SHA1

      fcc63f39c555bb473d58adc19800f08997279a1e

      SHA256

      81f5690aea9eee0eef572c9f1c1777650b34fbc31009dc5901ac24b38a4a4038

      SHA512

      79c0d488403213ba8bbefaa90ff99ca6e44b6a9a7f53e322042ac14743f6d91ca23cc38c43751ca807d85eb33433710d9b169431d667d6a8d709936843abf46d

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      b1ddb3f25f35a4f986bb505d62e7af27

      SHA1

      9743d2fbc537140d9a08cb52993be103c4233b49

      SHA256

      fb1266a77d2aa24320cf24d6f92e9b3078d355aa26e949f7ebd747fbe6840911

      SHA512

      c99950b5d2654f9c81c3b84dd4b1681db7772082004f92c0d1a285aa1badababefe46ee02e5388e47d5f1b02b61ca413e16c1326b40782e32c74b99d976b2906

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      323c1a7fb83d1d11ef53b6f8ff916d00

      SHA1

      19e3f3eabe89f5b0edbf396d822fad5ba7fe387d

      SHA256

      650c98ee09afb12538c1f689a510c83f0095a5db008739eae2689455778564eb

      SHA512

      f08d14fbe5e75b4476d7bdf3ddb205910c9245c2160a204e83c0d425c85321229764ea7803e8cf7d32cc6dd4af213dea8d8a9a8f993c37a9899d844271b62738

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      fdf9d479c147fbfce17f09ce56d6dc03

      SHA1

      bd8abe835bd5e9123532c9aaa4f16fdc7e69af19

      SHA256

      faec86df7d0beb35d30acce4e2b10fcf13f15a29dad1a9e3d62ebd83464d5a66

      SHA512

      4bc9f9a313f7f659d2cc905949439335ee092b41c8ff86d1ba37860e62a9fc01fd5521e774dcf58e74f5b277587e5992f74516c498d700c4e14090ae02e04a8e

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      a9d48d2e680a078ce83b6b9b878de286

      SHA1

      2603a5662d0eb7216599fa1190233c78212c9081

      SHA256

      055ba281787b1307e5efddd6ed64e4cac7f6a6e687801cdb65b66fd4d27b99ed

      SHA512

      9706074aa69b9b1427b3e114c4b893a1af087c1dc05bda794cd0e9eb93cda6b034d39e03656cfd859c8b1f88962326e44a8304eccf25496e07d02709e1a9ea22

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      96ebedf49e077764575255842e89048f

      SHA1

      62e6d37177d993be411b9cde5ad55bd458e24f50

      SHA256

      9b323711ede5882c1f87510ce576f55de66b304debd354e0f810c5555bd8623d

      SHA512

      5edd6ef76e04b1f47fd9871f19bb70dcb8ee22109f8cf7d832e8b5f8f420105a5dc5f734022ea866a8570d4b23e68755ad135e41a229dddc4e00507e1d4becb8

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      3a61d1283118c9936336d638e187d3d0

      SHA1

      c05fd667f772bc59e4b9cc43f0e88d1ffb8876c9

      SHA256

      de7a79107fd2a106cd901882f9b643121207fa215f64104d4a6ca3c9445e2a36

      SHA512

      b0be1072ae9a1d0a459b1b14cc5827d31cc7d5126a400e1a65bb7d36b1fa6445fc30098e6e655a18cb62245b70fb3605c2d88e5d591dec7380efab0d3449e6d3

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      2d7393948189f350373501be93788c20

      SHA1

      663cd911c615af9e7f1ea09860fd92059b8d0626

      SHA256

      2c652637810cc1d70cc4f97a4d8050a035979295e3587dddf01a568466bbcbbc

      SHA512

      5cf79bf452633d34959c1e4d009a6408f88bc9ab269f485bf24238e3e16387f5debfc5489315dac562a396e94d64eae19674f1e49e3af87d187ceee41120d2c9

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      2d3a030a1e66bfc5befd4fa1cdf4f20f

      SHA1

      e6624d6a4cb2e49bc054f12d6217103fa3e8dd2c

      SHA256

      bd424affe026db8f55a85fea707b07dd1d006026263d78036ffac6502345d65e

      SHA512

      721e16e2ce9961f971b1ae7c3e79ec29a7e3ffd16f23d246a38c1022e972ca0ee7ae22764bc1d5c0629128af9d8bf4c7803e700310097180c0e59a934aec4855

    • C:\Users\Admin\AppData\Roaming\logs.dat

      Filesize

      15B

      MD5

      bf3dba41023802cf6d3f8c5fd683a0c7

      SHA1

      466530987a347b68ef28faad238d7b50db8656a5

      SHA256

      4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

      SHA512

      fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

    • C:\Windows\SysWOW64\install\updated.exe

      Filesize

      1.1MB

      MD5

      db295321c287aceba94bdaa3b2141cb6

      SHA1

      18aeb11cf5e1d3579fb30862c56a70ace4b7ac45

      SHA256

      5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3

      SHA512

      07720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88

    • memory/1252-11-0x00000000025C0000-0x00000000025C1000-memory.dmp

      Filesize

      4KB

    • memory/2508-261-0x00000000000E0000-0x00000000000E1000-memory.dmp

      Filesize

      4KB

    • memory/2508-268-0x00000000000A0000-0x00000000000A1000-memory.dmp

      Filesize

      4KB

    • memory/2508-543-0x0000000024070000-0x00000000240D0000-memory.dmp

      Filesize

      384KB

    • memory/2508-891-0x0000000024070000-0x00000000240D0000-memory.dmp

      Filesize

      384KB

    • memory/2776-1-0x00000000000C0000-0x000000000010C000-memory.dmp

      Filesize

      304KB

    • memory/2776-5-0x00000000000C0000-0x000000000010C000-memory.dmp

      Filesize

      304KB

    • memory/2776-4-0x00000000000C0000-0x000000000010C000-memory.dmp

      Filesize

      304KB

    • memory/2776-2-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2776-6-0x00000000000C0000-0x000000000010C000-memory.dmp

      Filesize

      304KB

    • memory/2776-7-0x00000000000C0000-0x000000000010C000-memory.dmp

      Filesize

      304KB

    • memory/2776-870-0x00000000000C0000-0x000000000010C000-memory.dmp

      Filesize

      304KB

    • memory/2776-299-0x00000000000C0000-0x000000000010C000-memory.dmp

      Filesize

      304KB