cybergate | da1d0c4ba92f4f096d2773ccb1e7b2dd876ab50f63c810859677f576a96f327a

Analysis

max time kernel
157s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b34681ee7fc8566e3c6cd0417f9dd29.exe
Size 781KB
Sample221121-ft9r5sda37
SHA256 da1d0c4ba92f4f096d2773ccb1e7b2dd876ab50f63c810859677f576a96f327a
MD5 1b34681ee7fc8566e3c6cd0417f9dd29
SHA1 74ce26335bf2d361e963dccf82feb9d54894da74
SHA512 05fe5d55df944e37a88103d7960aee11c9d70c7be5a93de3e65c75f1b0f737dff0722bc95eae58e63b28d2d65b1f664812d215091bb4ef6b3b10b60b190575e2
SSDEEP 12288:dGEwCgvoS1MYlCWRTf74reOozXTNHIL9Km+tzx0Gz4GbCXC/tYJfb5:MC0oSGYlJqTbCzxt4GeQE5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate remote stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

remote

asade.no-ip.org:25565

Mutex

J368101A618OYR

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
injected_process
explorer.exe
install_dir
system
install_file
windows
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 1 IoCs

pid	Process
4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4336-144-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/4336-148-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4336-153-0x00000000104F0000-0x0000000010560000-memory.dmp	upx
behavioral2/memory/4444-156-0x00000000104F0000-0x0000000010560000-memory.dmp	upx
behavioral2/memory/4444-158-0x00000000104F0000-0x0000000010560000-memory.dmp	upx
behavioral2/memory/4444-160-0x00000000104F0000-0x0000000010560000-memory.dmp	upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\560.exe	1b34681ee7fc8566e3c6cd0417f9dd29.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\560.exe	1b34681ee7fc8566e3c6cd0417f9dd29.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system\windows	1b34681ee7fc8566e3c6cd0417f9dd29.exe
File opened for modification	C:\Windows\SysWOW64\system\windows	1b34681ee7fc8566e3c6cd0417f9dd29.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	explorer.exe
Token: SeDebugPrivilege	4444	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 1180 wrote to memory of 4336	1180	1b34681ee7fc8566e3c6cd0417f9dd29.exe	84
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85
PID 4336 wrote to memory of 4260	4336	1b34681ee7fc8566e3c6cd0417f9dd29.exe	85

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2764
- C:\Users\Admin\AppData\Local\Temp\1b34681ee7fc8566e3c6cd0417f9dd29.exe
  "C:\Users\Admin\AppData\Local\Temp\1b34681ee7fc8566e3c6cd0417f9dd29.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\1b34681ee7fc8566e3c6cd0417f9dd29.exe
    "C:\Users\Admin\AppData\Local\Temp\1b34681ee7fc8566e3c6cd0417f9dd29.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

1b34681ee7fc8566e3c6cd0417f9dd29.exe

Path C:\Users\Admin\AppData\Local\Temp\1b34681ee7fc8566e3c6cd0417f9dd29.exe
Size 781KB
SHA256 da1d0c4ba92f4f096d2773ccb1e7b2dd876ab50f63c810859677f576a96f327a
MD5 1b34681ee7fc8566e3c6cd0417f9dd29
SHA1 74ce26335bf2d361e963dccf82feb9d54894da74
SHA512 05fe5d55df944e37a88103d7960aee11c9d70c7be5a93de3e65c75f1b0f737dff0722bc95eae58e63b28d2d65b1f664812d215091bb4ef6b3b10b60b190575e2
SSDEEP 12288:dGEwCgvoS1MYlCWRTf74reOozXTNHIL9Km+tzx0Gz4GbCXC/tYJfb5:MC0oSGYlJqTbCzxt4GeQE5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Admin2.txt

Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Size 385KB
SHA256 a8cc21d1d4015ebd0e60ac238f320115496147b9f0d81720e090e0814f1951c4
MD5 3f2e087260a74e79c0cb5002e53a169f
SHA1 ad0d4028ac6dcd6bdb5972b176f2b6848f174619
SHA512 0229f0c8055a0d974f20d4c565868b1593e23615afea61ec48277d98998e52c57196dddb322d569c76a5d81c0ec09ca950ba76831962c7504beb4e4b170acbd7
SSDEEP 6144:QA0nitqv/nHrHxVPGTZTzq9SkTr2m7mrUsqWBn837FNldObO3k1jh:QBi8vvrHxVPKyv2m77sZB07FxObO32l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1180-134-0x0000000005D80000-0x0000000006324000-memory.dmp

Download

memory/1180-135-0x00000000056A0000-0x0000000005732000-memory.dmp

Download

memory/1180-136-0x00000000057D0000-0x000000000586C000-memory.dmp

Download

memory/1180-133-0x0000000000BF0000-0x0000000000CB8000-memory.dmp

Download

memory/4336-141-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4336-140-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4336-138-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4336-142-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4336-144-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/4336-148-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4336-153-0x00000000104F0000-0x0000000010560000-memory.dmp

Download

memory/4336-159-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4444-156-0x00000000104F0000-0x0000000010560000-memory.dmp

Download

memory/4444-158-0x00000000104F0000-0x0000000010560000-memory.dmp

Download

memory/4444-160-0x00000000104F0000-0x0000000010560000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads