cybergate | fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c

Analysis

max time kernel
151s
max time network
100s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe
Size

352KB
MD5

a2f7f1090d293a9e2576a9e283ca88c1
SHA1

42cb960015e90d4ea9cf879c8e799f8811422842
SHA256

fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c
SHA512

2fa7b33dce5e902ecb99f5a71d1aa9b174cdec36a0fb6adcfe68dd0474656ff893e34328767c7d963ab615ca60880a4985481d304827325cc4af395444ca2aec
SSDEEP

6144:6dHLo3hhZhhhhhhhhhhh4ahYhhhoUGkSHxhhhhhhhhhhhhh/hPWR6D6ckHlhyNcx:KbR6TdGYKHm2eF4dNfiWi7rZLP6Ue

Score

10^/10

cybergate remote persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

aznqmamrat.no-ip.biz:669

Mutex

1QWU2LN83JI080

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
PasswordOmg
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe

Executes dropped EXE 1 IoCs

pid	Process
1628	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0660D2XG-F5XT-8E16-KU76-4D42RXT606X3}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0660D2XG-F5XT-8E16-KU76-4D42RXT606X3}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0660D2XG-F5XT-8E16-KU76-4D42RXT606X3}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0660D2XG-F5XT-8E16-KU76-4D42RXT606X3}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1896-73-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral1/memory/1896-82-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1696-87-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1696-88-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1896-92-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral1/memory/1896-98-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1912-103-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1912-105-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1696-109-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1912-110-0x0000000010560000-0x00000000105C5000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1912	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\	vbc.exe
File created	C:\Windows\SysWOW64\install\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1896	vbc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	vbc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	1696	explorer.exe
Token: SeRestorePrivilege	1696	explorer.exe
Token: SeBackupPrivilege	1912	vbc.exe
Token: SeRestorePrivilege	1912	vbc.exe
Token: SeDebugPrivilege	1912	vbc.exe
Token: SeDebugPrivilege	1912	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 2016 wrote to memory of 1896	2016	fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe	26
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8
PID 1896 wrote to memory of 1368	1896	vbc.exe	8

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368
- C:\Users\Admin\AppData\Local\Temp\fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe
  "C:\Users\Admin\AppData\Local\Temp\fc7098f3f033524b025cdc9f17cade1e51541a9fc56e90df26f5f96557f3b18c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      Suspicious use of AdjustPrivilegeToken
      PID:1696
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1944
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1912
    - - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\system32\install\server.exe"
        5⤵
        Executes dropped EXE
        
        PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
f599a9b1ee4d501dbabc0c89e8702063

SHA1
2f22ef3178309863da38d9b884c6e5d368db35aa

SHA256
59a132772b825b3fc97cb515ee168a97a847dea4142cd5f6f8ee9ec450553782

SHA512
ea225bf6de41851734e9b8c3cc94398ad49bdac1f604a3d0261fd5f12976cd020952d48e5d8505a68b86f6eb2b28bd826cff9a62d723ba53cdbe94bdc1ddf951

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Windows\SysWOW64\install\server.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/1368-76-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1628-107-0x0000000000000000-mapping.dmp

Download
memory/1696-109-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1696-88-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1696-87-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1696-81-0x00000000752E1000-0x00000000752E3000-memory.dmp

Filesize
8KB

Download
memory/1696-79-0x0000000000000000-mapping.dmp

Download
memory/1896-63-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-61-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-56-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-71-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-73-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1896-67-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-66-0x000000000040E1A8-mapping.dmp

Download
memory/1896-65-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-82-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1896-57-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-62-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-69-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-60-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-92-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/1896-59-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1896-98-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1896-104-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1912-103-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1912-105-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1912-96-0x0000000000000000-mapping.dmp

Download
memory/1912-110-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-70-0x0000000074E10000-0x00000000753BB000-memory.dmp

Filesize
5.7MB

Download
memory/2016-55-0x0000000074E10000-0x00000000753BB000-memory.dmp

Filesize
5.7MB

Download