Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 12:33

General

  • Target

    c938aa7f743322a4ef51d036b8c4473962007d4f7809afab0380bcfa8271c108N.exe

  • Size

    3.5MB

  • MD5

    e5c1e4ec651a57211db07c8604596970

  • SHA1

    f7d22f1495e6b353f6b5eb80747d5c3339bd994e

  • SHA256

    c938aa7f743322a4ef51d036b8c4473962007d4f7809afab0380bcfa8271c108

  • SHA512

    744fde578077f0f13edf745afd68657482b7f8b405c8f8f06a58fe3a9cc74dd6cdcfffb9d28c26accc2df60e88b356aa3d09984f1511ca5057f10c443d89533c

  • SSDEEP

    12288:KJ4VPrzIIX06bgsZAyzcxNkekx7GNEnwQsEdUqJahKi17qGCIMNTMefl4z27iqLe:rVvfshku2tsEVJsKsnVefi0zRUwcd

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cyber

C2

thisisatest1.no-ip.biz:1540

Mutex

46438VM2KG604U

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WinDir

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\c938aa7f743322a4ef51d036b8c4473962007d4f7809afab0380bcfa8271c108N.exe
        "C:\Users\Admin\AppData\Local\Temp\c938aa7f743322a4ef51d036b8c4473962007d4f7809afab0380bcfa8271c108N.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\qtfQh.bat" "
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2436
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2840
        • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2896
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2488
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:2292
              • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1552
                • C:\Windows\SysWOW64\WinDir\Svchost.exe
                  "C:\Windows\system32\WinDir\Svchost.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2868
                  • C:\Windows\SysWOW64\WinDir\Svchost.exe
                    C:\Windows\SysWOW64\WinDir\Svchost.exe
                    7⤵
                    • Executes dropped EXE
                    PID:2764

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

        Filesize

        224KB

        MD5

        77698ede07c64e9b8e38b9bf55af47b2

        SHA1

        a124b36a88417b10da71edc04543a96bd70fa799

        SHA256

        43d0fbc64601023ec2c7ed38b7f11826089e10f71387d2b29b7f1e24ffef34c2

        SHA512

        77f4d24fbb4622b7bec8c4f3ad178dcc4cf25dc10a611bb891fc897e6c74504afad367724fd657446f52b96296d8967ff71ca6287ae2ad1cbe68885ae772b22d

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        79f33412bc5ff0245506e0ca0ac3f9d5

        SHA1

        e5c53b0d85f99093675e8d86ad0bdc636f074137

        SHA256

        07da1eb2eae0c8fa9bfd8e17b18a4ed96b1f907f0bdd1d694e52520de5d3e3d2

        SHA512

        a3616e08ce5465ecdf0453501913f04abca30d8328c2a55c08b485d17430b1659e21e0afa0c0561e52436324f8b768ab66c614794d74dbac47e5cc0242e2c1e0

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        809ea17d86e2788c57bf072eb5352cb9

        SHA1

        0e21a412d2ce772349a1ca77cee6ef6e42c2dca1

        SHA256

        7e1bab217d5cf001954a3cdc68c576bbf93d8334ae90b546493d760902ae9e49

        SHA512

        31d163dac91a0b4bf2cb6b4ad365333b73876c065661d5360fe4f4e06bcf73b18308692e5e8a9b6c71b513ac3e0047369d4b6642f14355ffea2b4b1dfc082451

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        e99e617a72de203641b7b78c81cfe6fb

        SHA1

        96837176fd987dbb4b0e1f90751a37a4a1c06606

        SHA256

        f1e6d191643be09eeefee1a2747e82872d910ebff509bf141bdb7c662d2c25ca

        SHA512

        66b35c182b87d6c197576b4ea84bb83647719f965008ed964d84b49a7688b00a57ac6862e3eee402197cdbc1fefb6c61133e2c6178e6494e2e8bba8d3037315e

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        c275d87972181ca2d91a0f2fb9f30e46

        SHA1

        49df0704ab4c7068e9941fd5b3460a82a1f7f9dc

        SHA256

        c47dd916f17ddc0fb17231dc7ed4b8a27ee8aa1b4452e22ce4d9f60ee012dfe2

        SHA512

        476e82340323c933ac8787ecf73859e0bb1a332b7e511727e2d967b33d2cc6332c37bea1625f33b751a514b5acce05b2045e3bb4cb2a2ef1701c1458aa53cb69

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        a0f6b8b38f17797aef9b28ad32ba7f96

        SHA1

        11e3d1971407923975e97b9044b8f47f5cfb5c17

        SHA256

        64c51705dcd1704fc579b65567411d4c8f7e9174c0fb95c0ae8860cbdce64971

        SHA512

        316ca389048f67b328eb248a6b5e01bc16e0751fa6dda0f03d5a4ae4575828d4fa0ed375ae4104e59fc7867ebb676fd3d13843ce7809b7ddfc9d399667662878

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        887a99e11837b670c9c9527ad35e5fb1

        SHA1

        7f22b50877116bfaec719855c1c06167318bba8d

        SHA256

        a38e9d7995014a83c4a1fd2e6e1c1b4d751775c7c8138e0f46b3f4317fbdebb1

        SHA512

        6612e67b7fcf98e57b337f789c21d9fb3c299a6796b88f600a292bbd569a62d6f773ae8d8dababa9761be2d8b7c87dbed23a0d2bce8ab67f22b7baa5f3625ea4

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        bb6e1efd811e9b98b772c7c974798c75

        SHA1

        84d10f8aef1a59fb1e8a61438ad5d06773c268d0

        SHA256

        d55dbe32887b354807a2415ae68020752a94a3a64a93cce511ae919dea42248a

        SHA512

        a098774dfad6b3658a3ef4a8b2d76104993710d5ce7b258ddff26a4dcef66bda28575c23de97d8ddc70bd5ac247ab2d86e4db7ee3465eaf513d34b55a0433fa3

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        985958052232ad839e2abfc6bb4243b1

        SHA1

        9b27b86445d73c19fb88b8beae10e92691b7cd30

        SHA256

        c030b390a7aea2e3ab054c4a167d6e7cdbac049787399aa0e25efc086634fedd

        SHA512

        86176055b19d4bb6b250946f754a098fc6602cf5a33e3065a8b2a12f8f366ba1ce40dc9541f550a13849f39f416c509d215cbec5bad0ca66edd27b0b57b108d0

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        92b4c1e33ad2bf2a93fe06ccf1a65405

        SHA1

        bc90551176280c0631a6edfc108dabf780338b8b

        SHA256

        48a89f8ba018a117cbdddec222a44a77cc26a27f2712901e72050dce6a84ec8e

        SHA512

        01c12aa9b29bc0ee7ba9a89ef1630f3c11c6c1202a0952c7e1037e8ec1b8bf885abb2f4f63e21b8b706cdc9073ca93ac2d768a266ff8338c0c241f452d60fde2

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        0ad093f3f8ff2aac9dce530bc6d2d03b

        SHA1

        86d3c52efda9b036d719ce8f851b5ce1b01afd40

        SHA256

        8ebbd20239a2428b26fb5e9b20704e5750b8a68a949afa9297fe609ec1e8aedf

        SHA512

        fc23089b6bebd122b36ac43c63b2d3a3fc32e5bb8c7cd17df0a20403a088344c80e0edfe3dc7dcd254e6acd42af4b316db3c4bb5743695abfcd0a2f6ca24a36e

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        9a1aedd609e6a4cf0bc72409068479e3

        SHA1

        63a119a5ff0c98baf56743e73853144956e90ac7

        SHA256

        9140443d17dbd2c78c73acfef1a5ec9eef9cf090aa4cc56c4775ceef430b1287

        SHA512

        2ffe82ef060ce54a34f2d093a8ebeab6edce3284caf0f34df21f6e7ceb49113a057d047e272cec683bb7783610f3238bcc3d32d612fcaa6ea6528e3d54af826c

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        1c5e2257d4c99f78af4a2c450c44cdda

        SHA1

        40cb47a011698c1b4eeb2049bd11fd3597047b6b

        SHA256

        8d91703fd39310de7326e2ccba25535b147b004e15be0b86db106bcac56a87d1

        SHA512

        6eeafe3c6ad8e8338385223a7d6aab62c2c6ef27dffba7391d475884b2a76edf273f5ec077276d527524bdb6c79d8dc33212d968621bea421b67de5835fa0842

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        32d91610ffd60b90b7cf779943b8b639

        SHA1

        1fa22b5c616598d27a0f803e4664f858d8c3fdff

        SHA256

        071bba7e399de810ad9ce978ddce132d4724816e583b282fa1ff0e8aed8953ae

        SHA512

        fbbcad35dfd6d89fd72bd6b07bf464f25e561193523a8635a7fa2fa3eec8fa7fd69e1aff3c40edd0efdba0aaddc563cd07665c02cd4e13448bb556f243cd14bd

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        c954f6f80dfecc71c2b80b799ab5e49f

        SHA1

        b8eb52f9bc3cc56cd52fa851e1a83004725fb7fc

        SHA256

        2b2f3cf86a432f26834c457aa622e0cf99c83122fddfc3b328a54f96ef1a70a8

        SHA512

        2960cf0c71c0fbb911e5caf322283b11d4699c8faed4614c6bab2e065fcc8a4a3373b5e63d09f9eee195d43807cf5a7a77e89ddedccccd985b9eccb08d3c02a0

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        5e8736dcdfd02a520b4fc9a94c879a6f

        SHA1

        d092eaab417330da10fc29e621280988e901c6c3

        SHA256

        34f79273b28919b2d3d7d8e18104e23634ad65641dbefe39d5f879fac653f099

        SHA512

        4b23c029130df4b4706a9af7d49197be0ce055028af4194fa9bde16919a101a9c14fa65bcf9efe4d6e836eb008f3f472e2fe8bed33265b23297ae785ad14f3b7

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        8f593f86f65266ffd05569123f77dcd2

        SHA1

        b56035124b1f1eff324e6dcb5da484e9e87856ab

        SHA256

        5beb89df48a8df0f7b1345a328501c3508d5a7c27fbe9cfdb54e18c1a6c43d9f

        SHA512

        ce12bf77ad8d1cf015039ad5884618b0f3c653b876273f189f42decb34fb9f9032f06ed6cfaa4c9578d6e9085558c1187ddefd94b293ca193ecbf5ea3582ab86

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        b7c62714fefba5eae2d2092e2e206e76

        SHA1

        5f76408354590cf5adfc0a64b7fd2ab83a0f1e83

        SHA256

        101a69c020e9b6f72865c7a1a1a010b9c26b4ef2714a9c2dedace56243ae590f

        SHA512

        1983c4ff896daae6f35c83dedfb3f5a143a9ef1302b7ba512997f1ea9d6616d15132f6e9a34b14fd9d9a54569e3a59b0da247b5a9986e5bdde2129923da9a35b

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        3146ec278d03071189e6fca9b7a47b2f

        SHA1

        3e985a300f27eb37ef53b1c487a173d89ab1fde3

        SHA256

        0acbbad5c12898a63bb710b7e88ca5880ba4a433757acedf58da15ad5517d9b1

        SHA512

        12656a0406c6c434818978e384db167ecdac1f9c637acd89e56ae24a5a47f3623ca00092ead6fe52d39c8ec66cf0edb404de2b367c848a168e0a206d331529b3

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        93b586087217e0e28fadd1c96baf2767

        SHA1

        e918a345b1a0c5b0311aad15949c15138c58112b

        SHA256

        50515e46b151ec1a3f22a893d3b78ef98a34ff1e7a2984c4e259ad665e5a4549

        SHA512

        2e02e282c0847b416a3fd9bd6e1ce01181d11cfa77891990adceed12a2752f1cdc50a64678c63ae9b8c30161ad7b22cb8e30d984622394ff326e4ad06991bdbb

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        44d2e02e4ddd88044239d34329068b0b

        SHA1

        3d79df3f03a00f574de728e494c6faf5f52613c6

        SHA256

        d268909cb5dff5f8104f44e2e04301304c4c7086aa558121157437a2969c1d30

        SHA512

        101d2c0771e109c349d47ee0d5ee6baedf317ef77f48f41341d576dfdb31511b3fb7cad17943744246322340899f0440e051f7ee16e67a9c996649d231e00368

      • C:\Users\Admin\AppData\Local\Temp\qtfQh.bat

        Filesize

        150B

        MD5

        4ed3f2796dfe0f1dcd1f4c585f81dd38

        SHA1

        0607e648a9f0ab0070c5c5dec2993e9f1abbcf40

        SHA256

        7e3737a5849d936edfb2acf0fd1ea2fb4caf1e2134c16801284cf06f957c32ae

        SHA512

        0020e28a09f20ee584f54bfb6e59b723f8ae175ec27470fe0794f4ba3036e97ccac4d86edfcc66a090704fe690dcfe4f992d11b9cec3e8312b0198d5d3231269

      • C:\Users\Admin\AppData\Roaming\Adminlog.dat

        Filesize

        15B

        MD5

        bf3dba41023802cf6d3f8c5fd683a0c7

        SHA1

        466530987a347b68ef28faad238d7b50db8656a5

        SHA256

        4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

        SHA512

        fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

      • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe

        Filesize

        3.5MB

        MD5

        6f4c90900fbbcd563de65c2a6653a43c

        SHA1

        271362361dc45500a84f788fd3618258b30c65be

        SHA256

        e8a8d76fcf5afe4af12be2ae997e1a062f422cdf4006efe01cff3e1a4cbefd2e

        SHA512

        9dd7567c408c4ada59281bbc54e9153ede2463f2e2538ac61c88c487b2ea63ee7dbd62714c8cd2be911bde7f747952b1452624a8859e5c192ffdebb42d4150e1

      • memory/1208-60-0x0000000002A30000-0x0000000002A31000-memory.dmp

        Filesize

        4KB

      • memory/1552-1003-0x0000000007CA0000-0x000000000801C000-memory.dmp

        Filesize

        3.5MB

      • memory/1552-683-0x0000000000400000-0x000000000077C000-memory.dmp

        Filesize

        3.5MB

      • memory/1552-1018-0x0000000007CA0000-0x000000000801C000-memory.dmp

        Filesize

        3.5MB

      • memory/2404-2-0x0000000000400000-0x000000000077C000-memory.dmp

        Filesize

        3.5MB

      • memory/2404-47-0x0000000003CF0000-0x000000000406C000-memory.dmp

        Filesize

        3.5MB

      • memory/2404-44-0x0000000000400000-0x000000000077C000-memory.dmp

        Filesize

        3.5MB

      • memory/2404-43-0x0000000003CF0000-0x000000000406C000-memory.dmp

        Filesize

        3.5MB

      • memory/2404-1010-0x0000000003CF0000-0x000000000406C000-memory.dmp

        Filesize

        3.5MB

      • memory/2764-1017-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/2764-1014-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/2868-1013-0x0000000000400000-0x000000000077C000-memory.dmp

        Filesize

        3.5MB

      • memory/2896-982-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/2896-55-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/2896-56-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/2896-54-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/2896-53-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/2896-50-0x0000000000400000-0x0000000000455000-memory.dmp

        Filesize

        340KB

      • memory/2980-1012-0x0000000000400000-0x000000000077C000-memory.dmp

        Filesize

        3.5MB

      • memory/2980-48-0x0000000000400000-0x000000000077C000-memory.dmp

        Filesize

        3.5MB