Overview

overview

10

Static

static

10

JaffaCakes...4b.exe

windows7-x64

10

JaffaCakes...4b.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23-02-2025 03:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_1e526c4dca7d214ab621eec1f309a84b.exe

  • Size

    281KB

  • MD5

    1e526c4dca7d214ab621eec1f309a84b

  • SHA1

    fbb76b81334bd523e29d601078bd65cdbbd1661a

  • SHA256

    1cdf3e0968a3772c56a84757a695d60f8aee2dd6a1121f9857e59298bdf17973

  • SHA512

    46c9dacf9539aac227545daf25e05666ba7a1ca47d02f66af1262f184d273c1b25735f16d0138113a8c126ce51b1ecd0c8e1a766e185b640b48cd417e67315ad

  • SSDEEP

    6144:gScrL/4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdRXijX:xcIy78QSVnNyhsFMCRSjX

Score
10/10
cybergateremotediscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

remote

C2

merabti01.no-ip.info:288

Mutex

X7777T320210SE

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate
  • Cybergate family
    cybergate
  • Adds policy Run key to start application 2 TTPs 8 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 5 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1368
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e526c4dca7d214ab621eec1f309a84b.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e526c4dca7d214ab621eec1f309a84b.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:812
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 272
            4⤵
            • Program crash
            PID:2008
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:2084
          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e526c4dca7d214ab621eec1f309a84b.exe
            "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e526c4dca7d214ab621eec1f309a84b.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2060
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 220
              4⤵
              • Program crash
              PID:904
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            3⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            PID:2112
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:932
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 268
                5⤵
                • Program crash
                PID:1092
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:2356
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\SysWOW64\install\server.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:884
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 216
                  5⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2656
              • C:\Users\Admin\AppData\Roaming\install\server.exe
                "C:\Users\Admin\AppData\Roaming\install\server.exe"
                4⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                PID:2580
                • C:\Windows\SysWOW64\explorer.exe
                  explorer.exe
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:932
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 272
                    6⤵
                    • Program crash
                    PID:3012
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  5⤵
                    PID:1072
                  • C:\Users\Admin\AppData\Roaming\install\server.exe
                    "C:\Users\Admin\AppData\Roaming\install\server.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2752
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 220
                      6⤵
                      • Loads dropped DLL
                      • Program crash
                      PID:2704

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
            Filesize

            236KB

            MD5

            059c2150cfa4a4c6508461275f7f2f4b

            SHA1

            6f7b9f7e983351b97e83f8e82359bb61c1932a11

            SHA256

            20d895b4e6094910cf3ed2e7fddf12f371062130256d711f90df829eff6e695d

            SHA512

            15fec0748579e61feb3ee5aabf73b1bc8eccc046c8dec932acc67762874dea0779d7f486f14c48d939c2164e97a91ec45392b1856e6af8f11b3ce7d7b9602413

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
            Filesize

            236KB

            MD5

            5af2658d30e7a68442d019ae4c211c4a

            SHA1

            5a4b9090e5b0ab105f8981bd9bc5df24a4405692

            SHA256

            f6691bc9b35e7f666cff9e9fa5e0597b5bc5c4ff2ac919d3a7d3d23d305cad13

            SHA512

            c22c7fd1cd5b9fe956567919eab9290f3483f90ca2d6335aeeb9efc4a97d2e47e0fdf06fb69cad1521ee77aa86b9b36835bc6bd7743e12070908e1b7de1e9c1b

            Download Submit

          • \Windows\SysWOW64\install\server.exe
            Filesize

            281KB

            MD5

            1e526c4dca7d214ab621eec1f309a84b

            SHA1

            fbb76b81334bd523e29d601078bd65cdbbd1661a

            SHA256

            1cdf3e0968a3772c56a84757a695d60f8aee2dd6a1121f9857e59298bdf17973

            SHA512

            46c9dacf9539aac227545daf25e05666ba7a1ca47d02f66af1262f184d273c1b25735f16d0138113a8c126ce51b1ecd0c8e1a766e185b640b48cd417e67315ad

            Download Submit

          • memory/812-250-0x00000000000E0000-0x00000000000E1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/812-249-0x00000000000A0000-0x00000000000A1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/812-531-0x0000000010490000-0x0000000010502000-memory.dmp

            Filesize

            456KB

            Download

          • memory/1368-3-0x0000000002750000-0x0000000002751000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2024-2-0x0000000010410000-0x0000000010482000-memory.dmp

            Filesize

            456KB

            Download