cybergate | e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831

Analysis

max time kernel
151s
max time network
145s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe
Size

290KB
MD5

92cd44844349b457f48cb3b42e1a1070
SHA1

a2365c39160eba57f8b3ff7eb2f287e935295a09
SHA256

e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831
SHA512

d0da50c2e18c7691fed667c7f0db38323d617ebb698ea395836ff671559bbc77829f66981c67009a01406580c8e9422457bea3e81024e44998d347a9bfca4613
SSDEEP

6144:MmcD66RRjF5JGmrpQsK3FD2u270jupCJsCxCb:9cD663A92zkPaCxk

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

seuno-ip.no-org:2000

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Desktop
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
teste

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\DJ Caio TiPoo Sheik\\Desktop\\Desktop\\server.exe"	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\DJ Caio TiPoo Sheik\\Desktop\\Desktop\\server.exe"	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe

Executes dropped EXE 1 IoCs

pid	Process
772	server.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Users\\DJ Caio TiPoo Sheik\\Desktop\\Desktop\\server.exe Restart"	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1448-56-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1448-65-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1212-70-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1212-78-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1212-79-0x0000000024080000-0x00000000240E2000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1212	explorer.exe
1212	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	explorer.exe
Token: SeDebugPrivilege	1212	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14
PID 1448 wrote to memory of 1392	1448	e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392
- C:\Users\Admin\AppData\Local\Temp\e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe
  "C:\Users\Admin\AppData\Local\Temp\e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
  - - C:\Users\DJ Caio TiPoo Sheik\Desktop\Desktop\server.exe
      "C:\Users\DJ Caio TiPoo Sheik\Desktop\Desktop\server.exe"
      4⤵
      Executes dropped EXE
      PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
cc15af9c0304b1d85e3aaf66cf979024

SHA1
6820fa99f6171f33289789aa3c3cbdb18170fb10

SHA256
4ed611defea18c9d2134515308ffc1d83a84be0aed75ba33c3401a1b1db76ef2

SHA512
f6b9e78037b0ef8fa481b9c43c8bb229faffb9b0f9eef8eaae80c88382d37441ea4459072f1eaf077289b6ab60460017044e18e4770783f02f8f6cb551d3ecde

Download Submit
C:\Users\DJ Caio TiPoo Sheik\Desktop\Desktop\server.exe

Filesize
290KB

MD5
92cd44844349b457f48cb3b42e1a1070

SHA1
a2365c39160eba57f8b3ff7eb2f287e935295a09

SHA256
e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831

SHA512
d0da50c2e18c7691fed667c7f0db38323d617ebb698ea395836ff671559bbc77829f66981c67009a01406580c8e9422457bea3e81024e44998d347a9bfca4613

Download Submit
C:\Users\DJ Caio TiPoo Sheik\Desktop\Desktop\server.exe

Filesize
290KB

MD5
92cd44844349b457f48cb3b42e1a1070

SHA1
a2365c39160eba57f8b3ff7eb2f287e935295a09

SHA256
e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831

SHA512
d0da50c2e18c7691fed667c7f0db38323d617ebb698ea395836ff671559bbc77829f66981c67009a01406580c8e9422457bea3e81024e44998d347a9bfca4613

Download Submit
\Users\DJ Caio TiPoo Sheik\Desktop\Desktop\server.exe

Filesize
290KB

MD5
92cd44844349b457f48cb3b42e1a1070

SHA1
a2365c39160eba57f8b3ff7eb2f287e935295a09

SHA256
e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831

SHA512
d0da50c2e18c7691fed667c7f0db38323d617ebb698ea395836ff671559bbc77829f66981c67009a01406580c8e9422457bea3e81024e44998d347a9bfca4613

Download Submit
\Users\DJ Caio TiPoo Sheik\Desktop\Desktop\server.exe

Filesize
290KB

MD5
92cd44844349b457f48cb3b42e1a1070

SHA1
a2365c39160eba57f8b3ff7eb2f287e935295a09

SHA256
e2257b7756e52ef3e26808888d1343fd1cf0e1bdfa3831362b41ca0cdb631831

SHA512
d0da50c2e18c7691fed667c7f0db38323d617ebb698ea395836ff671559bbc77829f66981c67009a01406580c8e9422457bea3e81024e44998d347a9bfca4613

Download Submit
memory/1212-70-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1212-64-0x0000000074951000-0x0000000074953000-memory.dmp

Filesize
8KB

Download
memory/1212-78-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1212-79-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1392-59-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1448-65-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1448-56-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download