Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2024, 08:16

General

  • Target

    cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2N.exe

  • Size

    296KB

  • MD5

    6afb13c14bf63d663dbe88d7f1fe0130

  • SHA1

    5e707443dc8dfc126f443fa405af457913dec921

  • SHA256

    cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2

  • SHA512

    e8d4adb40dcc6291c5eec5af649ac1f3b1c38faa398d8e76617c5bcc29cb2f449554ade6c6daf1f35505ada83c86d9fb473e5899d8bccb814aaa1e931fed2bf3

  • SSDEEP

    6144:POpslFlqthdBCkWYxuukP1pjSKSNVkq/MVJbf:PwslgTBd47GLRMTbf

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cyber

C2

stopscammingidiot.no-ip.biz:100

Mutex

G16V88J605XN2M

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    Svchost.exe

  • install_dir

    system32

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3524
      • C:\Users\Admin\AppData\Local\Temp\cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2N.exe
        "C:\Users\Admin\AppData\Local\Temp\cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2N.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1284
        • C:\Users\Admin\AppData\Local\Temp\cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2N.exe
          "C:\Users\Admin\AppData\Local\Temp\cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2N.exe"
          3⤵
          • Checks computer location settings
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2064
          • C:\Windows\SysWOW64\system32\Svchost.exe
            "C:\Windows\system32\system32\Svchost.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4768
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 576
              5⤵
              • Program crash
              PID:392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
      1⤵
        PID:2600

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

        Filesize

        225KB

        MD5

        c984ee4e691ced585db926a708f12885

        SHA1

        12a8dbda4054ae521f984d201fba216534e529c1

        SHA256

        a78e1dd943b83b337c11bc0528195a0e421e2ad2cb1802f1c297ec4fdd4931a0

        SHA512

        e09fd1b7ba00a30d838002e8789d18af0b6441cd72c7b84f153c49a37f391b16927589a596f7eff0acf3f5395c9646f9c653890faa64e12d822f9d1683e545d5

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        d0846fe9f43c44afa5aff400ab3c95fa

        SHA1

        700747cd0f68cae85740cb7786ec3587f8db6766

        SHA256

        fe4ac2b7b5fb3ec8ff8e5e5b6b1b8e1e279ee1c7c6c99ad75da162bc525431c8

        SHA512

        d163a3f94466a745d38da0bfdc5acf0c41a0ef35445c85c28f5a917f66328cc3ce6c1c1b92bcbb81c72a272f30badfd8fc39e6f1b14c13f396819d511b862491

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        d874694aa8cc4821c535932ecea0a0c7

        SHA1

        02c29717c328fbda3cb561c49a02d94ea94e0020

        SHA256

        a387f9654b304642a4ad74b42740742bfe9c18c3e627e4b76c647237ac2dbdfb

        SHA512

        2230097b73b520dd668295b73743f1c08713aa4d8677fd2da640a8b81fb6f900e271ed1d07626949ae144e0c428154a514946692aec002c8f6b1b0af2c37af78

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        589fa0325ad5259c452ed52bf9c2ed23

        SHA1

        acfb0398fa69adfc34d28b3c1cb08264a035009c

        SHA256

        008d7c669ab10ec45a45f82c2f4cfe2d674beab3da1fc025896dd0fa65266f25

        SHA512

        eb17e71f0683b562d9dfe3bc2a5f350aa904df541793c7f452c12c2c3df28bf67913b02777d3eaa0b2736ce0a8aa499a9f6ea1307014e66acb4c8f3ff85540a5

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        60d85430dcfefd7264c895cc85ba1872

        SHA1

        e99a3453e7778dae385e595581cba5a177fdbaba

        SHA256

        4e253e1b414c0dbc31ef5e97c3044f9797de5cca1c295558c0eae82eae537142

        SHA512

        003bc10f24c70bf3a2ff01b510558f81bc4736d47320a518b528244242725e1b663569c90986303e86db57a2630f66429c0a02c10d68213924b7fa7e920bc96a

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        9af7695a5a1e5a34aaf90ef4f50ff097

        SHA1

        728f3afcd5f94ff07522868518ef5c284bc4f607

        SHA256

        dce911a111497b3529c386c15c2d9c2f5fae0cdc371de112ab35e999a4a942f5

        SHA512

        4524834123ea5f6dca8dedeb20b15044993f1a346c9422c38fb3292cfac3f6bbae0a0ad754e2f83900170bf7e1d814b67ff20ce368742949c42df26dede55189

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        6211390467e8c242e62171f069632e62

        SHA1

        ae6daa7243f02390dc1fbae53c773a4c49054ee3

        SHA256

        2b980507d86560ba1ce60b2424618f2ae6e6ee5890a847f8fcfc9ff143950b13

        SHA512

        55f13eb533b124016f0fa005fb2bf757214f645f33bf93e4f2c58c0c22c59c4e92a0c52b05184d7e710b36682cd491e43f0bd4a1f45ba96d84f77bfdf5a1fc02

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        02326ee1dea8216a7d9094c017cd236d

        SHA1

        81484753a3ec734acd276a423f89426aba4e9500

        SHA256

        b0b6abb9603f85f40fbb23bbaf23c543ce3747a6913ed3225554513af9ca99a4

        SHA512

        5b45e2a657d143604cdd6e9a59a0d2df17be93cfd468dd9d3a4720930f93d1c4ac4068b25ba165de4ac4c3dcf0d2ea3233c5f002b2b5ebd48a276b5629229f39

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        75cf970f103f6d8483b8d4667a2a82d6

        SHA1

        00bd83e053e0e013333983ac2960fcc73e5e2934

        SHA256

        7a0eb26609c44b0f6b8523ed70d2749c882ee8a36ced370d2d49681b3684dc89

        SHA512

        6cbf2b480414f20f611e9557df9c8d6344ad56d1190ee081b8e0f0795bd19cd36fb7d2a741f918fb4b55904b08ff8b0f13ff8961ac7b37d929315aa7f4676744

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        959df2de621d4c71a3a64f1f559b3bba

        SHA1

        db2d0ffaa49ce97cdf41c485e59d7c4272c2fdc4

        SHA256

        8a19335c79450683d88042e585b12caf3b0c405425dea380bbe276e3a808ec4e

        SHA512

        9c98263bc11573615a5a8356b9320031f076eda879ba5bc267e0f801176b573466c6972be4ec242f6c8391ce02cd290a053f88b6a3172ad597505a3c09435a45

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        9ffaff7df55a286f02488c7f8e826963

        SHA1

        96ef924f952ea41db56763916c967e7e7e5df16f

        SHA256

        76b37de42204e056330ce68c960c4135bd02dd675e2d677441c3e422bbfdecfa

        SHA512

        f5658ad03497c12be69fa1800ddb17d565a8b7d64366d3416b99958cb16336cca6ec8bf23edbb9b586165f007b8eb1f2c7c84f22ceecd402f97c540b249514a9

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        930cc0a95436271d41458c0efdb9a561

        SHA1

        6764224e9c886354ba8d03c70a4537df79650601

        SHA256

        7486f686252f192353e07017da7af7526abc2c42b064b41e8f05c13394c3092b

        SHA512

        62f1a9a4dc0b20173f1dfb65e36b74cf5f0ea80e0b3577a35e0b3dd1e2f45268f07f214fc95f0b8f98db8f8ec9444c81227e7a927f987012518304281c2443d5

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        b9f71cbe7475aa18dbdccd041eecbb6a

        SHA1

        cf61209cd5b6e08aa68baa351eb0dc0371d08839

        SHA256

        2502f5ef2977cae62ad8955d6d82858b31eed6c805431cea634814765d1252b8

        SHA512

        c452b06b7fa4d6b424414ffae804d1d07b9f6ee4572c402ce524c7c86c32c7504fb552f20aa429b5013121c40cc4bde3cdc4cc3f2bc559714b3eff5c7990ef25

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        0dfade7ed5474075e49bc45e52e31e68

        SHA1

        a05e27de95fde38f87a01966739bc6a3ebde56bf

        SHA256

        98f854dbe9930910e9c1994e1fea1fd4c3fcd31067a13df584c5bbb0543fc627

        SHA512

        9c219d17256d74b204cb9055322dab67c031dd5671afc0a865e19e927d30348ea73a6bf706c534fef55e0c574d0458f9b4d459ca4f741177d026a35b3700cda0

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        fff8ba9d3432e50f92804628de7a238b

        SHA1

        140b924b26070ccadc8a6799adbf9d408657e3de

        SHA256

        259bf0fa2fc417f8e206bdb2516d724d76ed26767666077f01a80f949177277e

        SHA512

        f897226c5cde6a6071de1601cddc8e614bc4ab0931c9471bd1a19df66d08083df9d2410cae170fca0525dd43126185ecda9844758d28a9a9564560cd32bbb2e4

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        8a5354a6dfd209ba61881b37a65ace39

        SHA1

        a3c1ed3093fece83a05ec8c6ca4852b010e156f3

        SHA256

        b84a6fee1f847a798921dd12f57a92c2486a0ce70552a62d3248145af8dd052c

        SHA512

        c5e6991b43b4bd44927ce250d1725ed514a71a214b39a448be325478e861b48c97295979aeab1d60791b5e759977ed38380baf7e9313fadf163eef9054f1b57d

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        73cb717d52e69bea661e6cbd63b8baf2

        SHA1

        b1f1a7971ebfcc14c3ef358d41b1374334919192

        SHA256

        0e74ecad762198c3413b2b5edd74c9dc5c86fffd249aac49a9fcc0c8dfefddb4

        SHA512

        c25d9b291dfa9016bae95678a0d6e85f6fc39c13243797b8af3cf52622bfbe861d0dafbd8ec4bc7ca58dd6d8720a45fdfc16ccd327076280c530b289707d4fca

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        224262244ef148cae918812c3542d34e

        SHA1

        7f0229f778d4a81956255320c44eb38e2cf897e0

        SHA256

        fa97ecba8160f5e46cefb012ef1d2d1981c4655802c6cec35528b4581364b175

        SHA512

        911d9f45a8580ccb55995fd7f50b8fb7f23cef51c8c2a0a79450a32cd477ff9df2e21d441513f95677f8d7541ad83bf0c8b6116b442df5d5799aebd5f9ee24d8

      • C:\Users\Admin\AppData\Local\Temp\Admin7

        Filesize

        8B

        MD5

        0c6536d53eecf59bc4a8781cd7e73242

        SHA1

        be296c8926a5602079f459073402aa4826bcc0cc

        SHA256

        d9b01a41b1911f2ea31c97de13903872961e7d9e9f17850b35c2b41896f26621

        SHA512

        558a33f9464df4e1871e890928dc248de29281b51840961fc10bc809b3bd2ffd59beaf41e2c768c53a9473d1f14439d30b5b3c073ccf67b07b2807b7d41094e5

      • C:\Users\Admin\AppData\Roaming\Adminlog.dat

        Filesize

        15B

        MD5

        bf3dba41023802cf6d3f8c5fd683a0c7

        SHA1

        466530987a347b68ef28faad238d7b50db8656a5

        SHA256

        4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

        SHA512

        fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

      • C:\Windows\SysWOW64\system32\Svchost.exe

        Filesize

        296KB

        MD5

        6afb13c14bf63d663dbe88d7f1fe0130

        SHA1

        5e707443dc8dfc126f443fa405af457913dec921

        SHA256

        cd5d45fba6c736217301dae95df68b0842223b2781dc4b8aa2c8135903e538c2

        SHA512

        e8d4adb40dcc6291c5eec5af649ac1f3b1c38faa398d8e76617c5bcc29cb2f449554ade6c6daf1f35505ada83c86d9fb473e5899d8bccb814aaa1e931fed2bf3

      • memory/1284-68-0x0000000010480000-0x00000000104E5000-memory.dmp

        Filesize

        404KB

      • memory/1284-8-0x0000000000570000-0x0000000000571000-memory.dmp

        Filesize

        4KB

      • memory/1284-7-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/1284-66-0x00000000034A0000-0x00000000034A1000-memory.dmp

        Filesize

        4KB

      • memory/1284-157-0x0000000010480000-0x00000000104E5000-memory.dmp

        Filesize

        404KB

      • memory/1408-2-0x0000000010410000-0x0000000010475000-memory.dmp

        Filesize

        404KB

      • memory/1408-63-0x0000000010480000-0x00000000104E5000-memory.dmp

        Filesize

        404KB