Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 20:29

General

  • Target

    db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    db295321c287aceba94bdaa3b2141cb6

  • SHA1

    18aeb11cf5e1d3579fb30862c56a70ace4b7ac45

  • SHA256

    5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3

  • SHA512

    07720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaGPoPqZyONw4jDVslGWvn0GZ85:mJZoQrbTFZY1ia6d1jDyIYn0GZ85

Malware Config

Extracted

Family

cybergate

Version

v1.01.8

Botnet

remote

C2

freeforfree.ddns.net:999

Mutex

upgrade

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    updated.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    FUNCIOANL EXECUTOU

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3456
      • C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4684
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:1620
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3484
            • C:\Windows\SysWOW64\install\updated.exe
              "C:\Windows\system32\install\updated.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3952
              • C:\Windows\SysWOW64\install\updated.exe
                "C:\Windows\SysWOW64\install\updated.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

      Filesize

      221KB

      MD5

      0746e5babcefa3b07c8f315a42fcdabb

      SHA1

      8f6f15241bfe1d9f15f0f86af11e25f92d144cc0

      SHA256

      7ead0f724ec2fd62f1ed50b0856fda637fa8ef2ee5de8eb33fef1df58faa3806

      SHA512

      8025ba2a59c712dadfe932bfcce90a1a111e6b72a7346d0e114001afadb8e85d9374a857be3897f785d4a0dc5967fb2ea2ab675d46a69e79263758b8ee44ea8f

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      2d7d96e1506a9c6fea76419503f543fa

      SHA1

      e83d93d23c1f4a14293b199f70c266740cc4207a

      SHA256

      ab7c980be74f08772850f4e7d2eeed0cf98952c54f403f9231e7fa1d1811aaa4

      SHA512

      694c1efd63c03f9fcdb2d5fba091ed095b9443a052e8224a49682e6397d37ce99e38901219218053568a4742f47935b50e5a8dc6437297f58173c243c493fc4b

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      f9b2e83dec24981e83f8d65db8a9b102

      SHA1

      bf460acba8f7620c29481a97ba43e40a9f50d73a

      SHA256

      9751be5ac7a25caaa41431423f90e2eecc71112329a14fc93a9294125a1b6328

      SHA512

      a12c27f22de3ace3d88d5f6e9f369c9c55bd4ab37dedf39d81a4ae4e86b85dbca0ae2519027077e6b4042ed64c5e7ee394687bc57ac173162cc28e02e15b83d1

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      54e01f5251006d8fcd218f5994fc2e5b

      SHA1

      22f7fdb8fd52271ae806456425118fea50fc5203

      SHA256

      8cc854dfd9f5a483337e56a3ffba6eda2c1264aacd38c1d2373a62056c2f635f

      SHA512

      d11ae1d34a948e2585a7c49e096d141dbe4d8fabbe1237627b623c9c487792844c8bf8d0e2b119079f13e57e301347091119b7e4dfcc5847daa79be4ca26b82c

    • C:\Users\Admin\AppData\Local\Temp\XxX.xXx

      Filesize

      8B

      MD5

      32ee19a3f1036e7bcaeff1752e8425f9

      SHA1

      86850e6558a130bcc44723c378a02c1ee1410b3e

      SHA256

      e14d39fd72edac8c0323978d2119514c3dbbf8e318daa968e106bda638c1aa52

      SHA512

      2a5227ffb6c14c6c2a1c1a9e8f88f258c246d62ce44f7e1d65f5ca578423d73d7fbfa0a487f4b2f9d5da7a66ac4e10b19e383ea29c18557be403e5059abe56df

    • C:\Users\Admin\AppData\Roaming\logs.dat

      Filesize

      15B

      MD5

      bf3dba41023802cf6d3f8c5fd683a0c7

      SHA1

      466530987a347b68ef28faad238d7b50db8656a5

      SHA256

      4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

      SHA512

      fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

    • C:\Windows\SysWOW64\install\updated.exe

      Filesize

      1.1MB

      MD5

      db295321c287aceba94bdaa3b2141cb6

      SHA1

      18aeb11cf5e1d3579fb30862c56a70ace4b7ac45

      SHA256

      5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3

      SHA512

      07720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88

    • memory/1620-12-0x00000000004C0000-0x00000000004C1000-memory.dmp

      Filesize

      4KB

    • memory/1620-73-0x0000000024070000-0x00000000240D0000-memory.dmp

      Filesize

      384KB

    • memory/1620-11-0x0000000000400000-0x0000000000401000-memory.dmp

      Filesize

      4KB

    • memory/1620-159-0x0000000024070000-0x00000000240D0000-memory.dmp

      Filesize

      384KB

    • memory/3484-139-0x00000000240D0000-0x0000000024130000-memory.dmp

      Filesize

      384KB

    • memory/3484-163-0x00000000240D0000-0x0000000024130000-memory.dmp

      Filesize

      384KB

    • memory/4684-0-0x00000000000D0000-0x000000000011C000-memory.dmp

      Filesize

      304KB

    • memory/4684-27-0x00000000000D0000-0x000000000011C000-memory.dmp

      Filesize

      304KB

    • memory/4684-138-0x00000000000D0000-0x000000000011C000-memory.dmp

      Filesize

      304KB

    • memory/4684-10-0x0000000024070000-0x00000000240D0000-memory.dmp

      Filesize

      384KB

    • memory/4684-6-0x0000000024010000-0x0000000024070000-memory.dmp

      Filesize

      384KB

    • memory/4684-3-0x00000000000D0000-0x000000000011C000-memory.dmp

      Filesize

      304KB

    • memory/4684-2-0x00000000000D0000-0x000000000011C000-memory.dmp

      Filesize

      304KB

    • memory/4684-1-0x00000000000D0000-0x000000000011C000-memory.dmp

      Filesize

      304KB