Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2025 19:32

General

  • Target

    JaffaCakes118_7b653cac78805d23d12e93d6a3f7c6a0.exe

  • Size

    331KB

  • MD5

    7b653cac78805d23d12e93d6a3f7c6a0

  • SHA1

    8c58eda905bb0b5056ec574558cdafeab51fccb0

  • SHA256

    9b40f1da1d163db2532f58a4601cf3d5d2b5f3f2faabb3be66b5b6d0ebd180f3

  • SHA512

    e3a02bcb86a127396d0ff7d8bf7ddc2ec591e87957b3d3797181b75b64c749e00ec8d5609ccd9193f6a4ff0dab447c2b5736f409983f335b526548e04aed6654

  • SSDEEP

    6144:kPIgfIXgfpbmgwVsIWhYag5aQWe5/q5UFBR01g7bTHDeVV:YHfNfdc2Ixags9e5/EeBG1g7nHDeV

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÇáåßÑ ÇáÌäæÈí

C2

wolfff12.no-ip.biz:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b653cac78805d23d12e93d6a3f7c6a0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b653cac78805d23d12e93d6a3f7c6a0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b653cac78805d23d12e93d6a3f7c6a0.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b653cac78805d23d12e93d6a3f7c6a0.exe
      2⤵
        PID:2804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2236-0-0x0000000074471000-0x0000000074472000-memory.dmp

      Filesize

      4KB

    • memory/2236-1-0x0000000074470000-0x0000000074A1B000-memory.dmp

      Filesize

      5.7MB

    • memory/2236-2-0x0000000074470000-0x0000000074A1B000-memory.dmp

      Filesize

      5.7MB

    • memory/2236-20-0x0000000074470000-0x0000000074A1B000-memory.dmp

      Filesize

      5.7MB

    • memory/2804-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2804-19-0x0000000000400000-0x0000000000451000-memory.dmp

      Filesize

      324KB

    • memory/2804-15-0x0000000000400000-0x0000000000451000-memory.dmp

      Filesize

      324KB

    • memory/2804-13-0x0000000000400000-0x0000000000451000-memory.dmp

      Filesize

      324KB

    • memory/2804-9-0x0000000000400000-0x0000000000451000-memory.dmp

      Filesize

      324KB

    • memory/2804-7-0x0000000000400000-0x0000000000451000-memory.dmp

      Filesize

      324KB

    • memory/2804-5-0x0000000000400000-0x0000000000451000-memory.dmp

      Filesize

      324KB

    • memory/2804-4-0x0000000000400000-0x0000000000451000-memory.dmp

      Filesize

      324KB

    • memory/2804-11-0x0000000000400000-0x0000000000451000-memory.dmp

      Filesize

      324KB