cybergate | 4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc

General

Target

4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe
Size

776KB
MD5

6950c7661fbe679ffa1e84abfe1a0b80
SHA1

87b391dc9f8cec35d3422500816719ebf39339f4
SHA256

4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc
SHA512

a529e302f0e0a24fb177cfa4279ad8fc0e19a09c0425a9175ce8fa2b0bde58db498a3ec2bb2f61668f5e3946d79d8e200426f0b42c9a253d8b205a3377cf4af6
SSDEEP

12288:gXuaWe+Uzq+5keKmlHpKydeZJ7aUBTqKgYv+L3pdnxZaq:gXRW/gUZJLTXGz

Score

10^/10

cybergate zombie persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Zombie

C2

xortdan.no-ip.org:85

Mutex

T74RW012J0848D

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Windir
install_file
Svchost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
lopas

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Executes dropped EXE 1 IoCs

Processes:

Svchost.exe

pid process

956 Svchost.exe

pid	process
956	Svchost.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{O6532OUJ-8G75-672F-C3U0-133O654S7DN3}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{O6532OUJ-8G75-672F-C3U0-133O654S7DN3}\StubPath = "C:\\Windows\\Windir\\Svchost.exe Restart"	vbc.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1616-60-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1616-62-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1616-63-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1616-69-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1616-68-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1616-70-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1616-72-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral1/memory/1616-78-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1616-84-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1792-83-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1792-87-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1792-91-0x0000000010480000-0x00000000104E5000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exevbc.exe

pid	process
1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe
1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe
1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe
1792	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe

description	pid	process	target process
PID 1736 set thread context of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe

Drops file in Windows directory 2 IoCs

Processes:

vbc.exe

description ioc process

File opened for modification C:\Windows\Windir\Svchost.exe vbc.exe
File created C:\Windows\Windir\Svchost.exe vbc.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

vbc.exe

pid process

1616 vbc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vbc.exe

pid process

1792 vbc.exe

description	ioc	process
File opened for modification	C:\Windows\Windir\Svchost.exe	vbc.exe
File created	C:\Windows\Windir\Svchost.exe	vbc.exe

pid	process
1616	vbc.exe

pid	process
1792	vbc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeBackupPrivilege	1792	vbc.exe
Token: SeRestorePrivilege	1792	vbc.exe
Token: SeDebugPrivilege	1792	vbc.exe
Token: SeDebugPrivilege	1792	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exevbc.exe

description	pid	process	target process
PID 1736 wrote to memory of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe
PID 1736 wrote to memory of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe
PID 1736 wrote to memory of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe
PID 1736 wrote to memory of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe
PID 1736 wrote to memory of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe
PID 1736 wrote to memory of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe
PID 1736 wrote to memory of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe
PID 1736 wrote to memory of 1616	1736	4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe	vbc.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe
PID 1616 wrote to memory of 1988	1616	vbc.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe
"C:\Users\Admin\AppData\Local\Temp\4ffaf26aa6b91cf037df0e1c565235b8e369ce5bc7ed8daf590ce29d3f6dd0bc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1616

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1988

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
3⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\Windir\Svchost.exe
"C:\Windows\Windir\Svchost.exe"
4⤵
- Executes dropped EXE
PID:956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
224KB

MD5
621c26bb7e0d60eaa6a094764ed97536

SHA1
83bf598f3d4cc33fa855d8326dc2c4dd28e40aa9

SHA256
b600f3e20650b15482d0ab1b82d35c0dba8bcb6d03b531d92d44fb78f995b1c9

SHA512
707973f1d09cab39d75745c23290259c496b10e0985bd9bcb0269b2124995b4dab8609434c21acf87999a53b6f3735a7d5e09aeee2ec10cb5c3c9a0d8a9ba548

Download Submit
C:\Windows\Windir\Svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Windows\Windir\Svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\User32.dll
Filesize
18KB

MD5
5fa07d6c6384d703766d7935de68850e

SHA1
62f28a572b4d1d359db7017235912ad2599b8c1d

SHA256
120e15dcc4a957649553cd92a5477db9dcbfd9a2cd821e1c904044b5a92d726f

SHA512
7775375f44e0cb00f9bffc023d797dbdb01ebe8429ccfacd7df57beb04427ef309c192d571051242aad1bc400f721f449f86deeb1e5f5d64b6f516bf24e92cc4

Download Submit
\Users\Admin\AppData\Local\Temp\User32.dll
Filesize
18KB

MD5
5fa07d6c6384d703766d7935de68850e

SHA1
62f28a572b4d1d359db7017235912ad2599b8c1d

SHA256
120e15dcc4a957649553cd92a5477db9dcbfd9a2cd821e1c904044b5a92d726f

SHA512
7775375f44e0cb00f9bffc023d797dbdb01ebe8429ccfacd7df57beb04427ef309c192d571051242aad1bc400f721f449f86deeb1e5f5d64b6f516bf24e92cc4

Download Submit
\Users\Admin\AppData\Local\Temp\User32.dll
Filesize
18KB

MD5
5fa07d6c6384d703766d7935de68850e

SHA1
62f28a572b4d1d359db7017235912ad2599b8c1d

SHA256
120e15dcc4a957649553cd92a5477db9dcbfd9a2cd821e1c904044b5a92d726f

SHA512
7775375f44e0cb00f9bffc023d797dbdb01ebe8429ccfacd7df57beb04427ef309c192d571051242aad1bc400f721f449f86deeb1e5f5d64b6f516bf24e92cc4

Download Submit
\Windows\Windir\Svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/956-89-0x0000000000000000-mapping.dmp

Download
memory/1616-68-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1616-78-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1616-59-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1616-69-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1616-60-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1616-70-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1616-72-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1616-62-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1616-63-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1616-64-0x0000000000454010-mapping.dmp

Download
memory/1616-84-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1736-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1736-67-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-58-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1792-83-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1792-81-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1792-76-0x0000000000000000-mapping.dmp

Download
memory/1792-87-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1792-91-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads