cybergate | 9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

General

Target

EA2A9551A96D5F6EF23988D210235284.exe
Size

725KB
MD5

ea2a9551a96d5f6ef23988d210235284
SHA1

aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32
SHA256

9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45
SHA512

f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Score

10^/10

cybergate remote stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

remote

C2

asade.no-ip.org:25565

Mutex

HBT82J40JIS366

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
rdns
install_file
windows
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
erterterter
regkey_hklm
sdsdfsdf

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Executes dropped EXE 2 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exeEA2A9551A96D5F6EF23988D210235284.exe

pid process

2692 EA2A9551A96D5F6EF23988D210235284.exe
412 EA2A9551A96D5F6EF23988D210235284.exe

pid	process
2692	EA2A9551A96D5F6EF23988D210235284.exe
412	EA2A9551A96D5F6EF23988D210235284.exe

Drops startup file 2 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\892.exe	EA2A9551A96D5F6EF23988D210235284.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\892.exe	EA2A9551A96D5F6EF23988D210235284.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exe

description pid process target process

PID 632 set thread context of 2692 632 EA2A9551A96D5F6EF23988D210235284.exe EA2A9551A96D5F6EF23988D210235284.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3136 412 WerFault.exe EA2A9551A96D5F6EF23988D210235284.exe

description	pid	process	target process
PID 632 set thread context of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe

pid	pid_target	process	target process
3136	412	WerFault.exe	EA2A9551A96D5F6EF23988D210235284.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe
3136	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3136 WerFault.exe
Token: SeBackupPrivilege 3136 WerFault.exe
Token: SeDebugPrivilege 3136 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3136	WerFault.exe
Token: SeBackupPrivilege	3136	WerFault.exe
Token: SeDebugPrivilege	3136	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EA2A9551A96D5F6EF23988D210235284.exeEA2A9551A96D5F6EF23988D210235284.exe

C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
"C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
  "C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe
    "C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe"
    3⤵
    - Executes dropped EXE
    PID:412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 708
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
C:\Users\Admin\AppData\Local\Temp\EA2A9551A96D5F6EF23988D210235284.exe

MD5
ea2a9551a96d5f6ef23988d210235284

SHA1
aa63dc4def37eaa7cbdcccecc0fa290a2e4baa32

SHA256
9e0c6888bb6e17c927b7b52656b067562b7ef4607ca3963c8e13637235432c45

SHA512
f08028db66063a6e47cdfce8cf5ffea5b14d724dedfce1ae06eb81b1e30dd4398dc8f6599210531b48ff236ab63ab8d7715321406dbd28a7e2f02e713062c882

Download Submit
memory/412-135-0x00000000011B0000-0x00000000012FA000-memory.dmp

Filesize
1.3MB

Download
memory/412-128-0x0000000000F60000-0x0000000000F61000-memory.dmp

Filesize
4KB

Download
memory/412-127-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/412-125-0x0000000000000000-mapping.dmp

Download
memory/632-118-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/632-119-0x00000000051A0000-0x00000000051A7000-memory.dmp

Filesize
28KB

Download
memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/632-117-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/632-116-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/2692-121-0x0000000000409860-mapping.dmp

Download
memory/2692-123-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2692-120-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

description	pid	process	target process
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 632 wrote to memory of 2692	632	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe
PID 2692 wrote to memory of 412	2692	EA2A9551A96D5F6EF23988D210235284.exe	EA2A9551A96D5F6EF23988D210235284.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads