cybergate | af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
Size

308KB
MD5

a02e999f6aec99fdc0a6e63cf835bee0
SHA1

1513a1088a79bf5afac7a3afeb99c39bc6ea1ea8
SHA256

af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd
SHA512

a9ff32174c1d9136cfdc30cce4a1d385849fa33a08701586c6829a981583fbed531b1f513137d01f16ea7a83e54a872bfd52d697cfb61d01101e4a9283bf634e
SSDEEP

6144:sd77UGb3ir2GKWvrTyfzbvUun7ZLgI4l47twzHa/K38Py9:sd7gs3ir2G3DT8zb3ZLa47tka/K38

Score

10^/10

cybergate vítima stealer trojan

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

bazooka.no-ip.org:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
dllx.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
#12fga14.dll est introuvable!
message_box_title
information !!!!
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	5080	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5080	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4396	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	84
PID 4944 wrote to memory of 4396	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	84
PID 4944 wrote to memory of 4396	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	84
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85
PID 4944 wrote to memory of 5080	4944	af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe	85

C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
"C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
  C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
  2⤵
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
  C:\Users\Admin\AppData\Local\Temp\af783bdb90245836483b385826baeedbf948f0f547e8d872c45177ced4cbf5dd.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 12
    3⤵
    - Program crash
    PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5080 -ip 5080
1⤵
PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4944-132-0x0000000000220000-0x0000000000274000-memory.dmp

Filesize
336KB

Download
memory/4944-133-0x0000000004C90000-0x0000000004D2C000-memory.dmp

Filesize
624KB

Download
memory/5080-135-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download