cybergate | af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
Size

308KB
MD5

a02e999f6aec99fdc0a6e63cf835bee0
SHA1

1513a1088a79bf5afac7a3afeb99c39bc6ea1ea8
SHA256

af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd
SHA512

a9ff32174c1d9136cfdc30cce4a1d385849fa33a08701586c6829a981583fbed531b1f513137d01f16ea7a83e54a872bfd52d697cfb61d01101e4a9283bf634e
SSDEEP

6144:sd77UGb3ir2GKWvrTyfzbvUun7ZLgI4l47twzHa/K38Py9:sd7gs3ir2G3DT8zb3ZLa47tka/K38

Score

10^/10

cybergate vítima stealer trojan

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

bazooka.no-ip.org:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
dllx.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
#12fga14.dll est introuvable!
message_box_title
information !!!!
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1132 set thread context of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1696	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	27
PID 1132 wrote to memory of 1696	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	27
PID 1132 wrote to memory of 1696	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	27
PID 1132 wrote to memory of 1696	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	27
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28
PID 1132 wrote to memory of 1324	1132	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	28

C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
"C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
  C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
  C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
  2⤵
  PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-54-0x00000000011F0000-0x0000000001244000-memory.dmp

Filesize
336KB

Download
memory/1324-55-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1324-56-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1324-60-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1324-61-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1324-59-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1324-58-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1324-62-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1324-64-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download