cybergate | 9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

Analysis

max time kernel
112s
max time network
48s
platform
windows7_x64
resource
win7v20210410
submitted
08-07-2021 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EA2A9551A96D5F6EF23988D210235284.exe
Size

725KB
MD5

ea2a9551a96d5f6ef23988d210235284
SHA1

aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32
SHA256

9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45
SHA512

f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Score

10^/10

cybergate remote stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

remote

asade.no-ip.org:25565

Mutex

HBT82J40JIS366

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
rdns
install_file
windows
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
erterterter
regkey_hklm
sdsdfsdf

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Executes dropped EXE 2 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exeEA2A9551A96D5F6EF23988D210235284.exe

pid process

1940 EA2A9551A96D5F6EF23988D210235284.exe
608 EA2A9551A96D5F6EF23988D210235284.exe

pid	process
1940	EA2A9551A96D5F6EF23988D210235284.exe
608	EA2A9551A96D5F6EF23988D210235284.exe

Drops startup file 2 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\791.exe	EA2A9551A96D5F6EF23988D210235284.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\791.exe	EA2A9551A96D5F6EF23988D210235284.exe

Loads dropped DLL 7 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exeEA2A9551A96D5F6EF23988D210235284.exeWerFault.exe

pid	process
1644	EA2A9551A96D5F6EF23988D210235284.exe
1940	EA2A9551A96D5F6EF23988D210235284.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exe

description pid process target process

PID 1644 set thread context of 1940 1644 EA2A9551A96D5F6EF23988D210235284.exe EA2A9551A96D5F6EF23988D210235284.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

512 608 WerFault.exe EA2A9551A96D5F6EF23988D210235284.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

512 WerFault.exe
512 WerFault.exe
512 WerFault.exe
512 WerFault.exe
512 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

512 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 512 WerFault.exe

description	pid	process	target process
PID 1644 set thread context of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe

pid	pid_target	process	target process
512	608	WerFault.exe	EA2A9551A96D5F6EF23988D210235284.exe

pid	process
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe
512	WerFault.exe

pid	process
512	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	512	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exeEA2A9551A96D5F6EF23988D210235284.exe

C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
"C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
  "C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
    "C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
    3⤵
    - Executes dropped EXE
    PID:608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 232
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
memory/512-113-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/512-107-0x0000000000000000-mapping.dmp

Download
memory/608-72-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/608-73-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/608-70-0x0000000000000000-mapping.dmp

Download
memory/1644-61-0x0000000000480000-0x0000000000487000-memory.dmp

Filesize
28KB

Download
memory/1644-59-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/1940-63-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1940-67-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1940-66-0x00000000757D1000-0x00000000757D3000-memory.dmp

Filesize
8KB

Download
memory/1940-64-0x0000000000409860-mapping.dmp

Download

description	pid	process	target process
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1644 wrote to memory of 1940	1644	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 1940 wrote to memory of 608	1940	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe