cybergate | 9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

Analysis

max time kernel
19s
max time network
119s
platform
windows10_x64
resource
win10v20210408
submitted
08-07-2021 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EA2A9551A96D5F6EF23988D210235284.exe
Size

725KB
MD5

ea2a9551a96d5f6ef23988d210235284
SHA1

aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32
SHA256

9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45
SHA512

f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Score

10^/10

cybergate remote stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

remote

asade.no-ip.org:25565

Mutex

HBT82J40JIS366

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
rdns
install_file
windows
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
erterterter
regkey_hklm
sdsdfsdf

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 2 IoCs

pid	Process
2692	EA2A9551A96D5F6EF23988D210235284.exe
412	EA2A9551A96D5F6EF23988D210235284.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\892.exe	EA2A9551A96D5F6EF23988D210235284.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\892.exe	EA2A9551A96D5F6EF23988D210235284.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3136	412	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3136	WerFault.exe
Token: SeBackupPrivilege	3136	WerFault.exe
Token: SeDebugPrivilege	3136	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	75
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	76

C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
"C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
  "C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
    "C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
    3⤵
    - Executes dropped EXE
    PID:412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 708
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-135-0x00000000011B0000-0x00000000012FA000-memory.dmp

Filesize
1.3MB

Download
memory/412-128-0x0000000000F60000-0x0000000000F61000-memory.dmp

Filesize
4KB

Download
memory/412-127-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/632-118-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/632-119-0x00000000051A0000-0x00000000051A7000-memory.dmp

Filesize
28KB

Download
memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/632-117-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/632-116-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/2692-123-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2692-120-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download