cybergate | 9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

Analysis

max time kernel
112s
max time network
48s
platform
windows7_x64
resource
win7v20210410
submitted
08/07/2021, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EA2A9551A96D5F6EF23988D210235284.exe
Size

725KB
MD5

ea2a9551a96d5f6ef23988d210235284
SHA1

aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32
SHA256

9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45
SHA512

f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Score

10^/10

cybergate remote stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

remote

asade.no-ip.org:25565

Mutex

HBT82J40JIS366

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
rdns
install_file
windows
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
erterterter
regkey_hklm
sdsdfsdf

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 2 IoCs

pid	Process
1940	EA2A9551A96D5F6EF23988D210235284.exe
608	EA2A9551A96D5F6EF23988D210235284.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\791.exe	EA2A9551A96D5F6EF23988D210235284.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\791.exe	EA2A9551A96D5F6EF23988D210235284.exe

Loads dropped DLL 7 IoCs

pid	Process
1644	EA2A9551A96D5F6EF23988D210235284.exe
1940	EA2A9551A96D5F6EF23988D210235284.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26

Program crash 1 IoCs

pid	pid_target	Process	procid_target
512	608	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
512	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	26
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	29

C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
"C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
  "C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
    "C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
    3⤵
    - Executes dropped EXE
    PID:608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 232
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-113-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/608-73-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/608-72-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1644-61-0x0000000000480000-0x0000000000487000-memory.dmp

Filesize
28KB

Download
memory/1644-59-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/1940-67-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1940-66-0x00000000757D1000-0x00000000757D3000-memory.dmp

Filesize
8KB

Download
memory/1940-63-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download