cybergate | 815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

Analysis

max time kernel
154s
max time network
150s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
Size

1.0MB
MD5

501beaec545972571ca743ff468cae5b
SHA1

4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c
SHA256

815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6
SHA512

2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a
SSDEEP

12288:EjkArEN249AyE/rbaMct4bO2/Vf0cCoFmZv07A6IdSlloroY30wnqomLskYtI:nFE//Tct4bOsyczmydI8lycOqdcI

Score

10^/10

cybergate hottrod persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

hottrod

d16.no-ip.biz:3178

Mutex

L7471Y70V2WVK3

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
m2340440

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svzhost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svzhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	svzhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svzhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	svzhost.exe

Drops file in Drivers directory 4 IoCs

Processes:

815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exesvzhost.exeserver.exesvzhost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svzhost.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	server.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svzhost.exe

Executes dropped EXE 8 IoCs

Processes:

svzhost.exesvzhost.exesvzhost.exeserver.exesvzhost.exesvzhost.exesvzhost.exesvzhost.exe

pid process

1584 svzhost.exe
1508 svzhost.exe
1012 svzhost.exe
1672 server.exe
536 svzhost.exe
1760 svzhost.exe
980 svzhost.exe
1740 svzhost.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svzhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{38W108GQ-O055-YL24-B138-U1PNC3D7XXMR}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe Restart"	svzhost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{38W108GQ-O055-YL24-B138-U1PNC3D7XXMR}	svzhost.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2044-56-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2044-62-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
\Users\Admin\AppData\Roaming\svzhost.exe	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
behavioral1/memory/1584-69-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2044-77-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
behavioral1/memory/1508-86-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/1508-89-0x0000000010410000-0x0000000010471000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
behavioral1/memory/1012-96-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/1508-97-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral1/memory/1012-102-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
C:\directory\CyberGate\install\server.exe	upx
\directory\CyberGate\install\server.exe	upx
C:\directory\CyberGate\install\server.exe	upx
behavioral1/memory/1672-113-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/1012-114-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral1/memory/536-122-0x0000000000400000-0x0000000000421000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
behavioral1/memory/536-127-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/536-128-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/536-129-0x0000000000400000-0x0000000000421000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
behavioral1/memory/1760-134-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/1584-141-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
behavioral1/memory/1672-151-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
behavioral1/memory/1740-161-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1012-163-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral1/memory/536-164-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1760-165-0x0000000000400000-0x00000000004E5000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exesvzhost.exe

pid process

2044 815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
1012 svzhost.exe

pid	process
2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
1012	svzhost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exe815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exesvzhost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\svzhost.exe"	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\svzhost.exe"	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	svzhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\svzhost.exe"	svzhost.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exeserver.exesvzhost.exesvzhost.exe

description	ioc	process
File opened (read-only)	\??\l:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\v:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\g:	server.exe
File opened (read-only)	\??\g:	svzhost.exe
File opened (read-only)	\??\k:	svzhost.exe
File opened (read-only)	\??\o:	svzhost.exe
File opened (read-only)	\??\e:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\m:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\i:	svzhost.exe
File opened (read-only)	\??\y:	svzhost.exe
File opened (read-only)	\??\f:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\u:	svzhost.exe
File opened (read-only)	\??\v:	svzhost.exe
File opened (read-only)	\??\b:	server.exe
File opened (read-only)	\??\r:	server.exe
File opened (read-only)	\??\s:	server.exe
File opened (read-only)	\??\i:	svzhost.exe
File opened (read-only)	\??\j:	svzhost.exe
File opened (read-only)	\??\r:	svzhost.exe
File opened (read-only)	\??\t:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\x:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\e:	svzhost.exe
File opened (read-only)	\??\k:	svzhost.exe
File opened (read-only)	\??\y:	server.exe
File opened (read-only)	\??\e:	svzhost.exe
File opened (read-only)	\??\l:	svzhost.exe
File opened (read-only)	\??\s:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\v:	svzhost.exe
File opened (read-only)	\??\x:	svzhost.exe
File opened (read-only)	\??\z:	svzhost.exe
File opened (read-only)	\??\s:	svzhost.exe
File opened (read-only)	\??\r:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\j:	svzhost.exe
File opened (read-only)	\??\w:	server.exe
File opened (read-only)	\??\b:	svzhost.exe
File opened (read-only)	\??\n:	svzhost.exe
File opened (read-only)	\??\t:	svzhost.exe
File opened (read-only)	\??\h:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\q:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\l:	svzhost.exe
File opened (read-only)	\??\w:	svzhost.exe
File opened (read-only)	\??\x:	svzhost.exe
File opened (read-only)	\??\u:	server.exe
File opened (read-only)	\??\u:	svzhost.exe
File opened (read-only)	\??\y:	svzhost.exe
File opened (read-only)	\??\o:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\a:	svzhost.exe
File opened (read-only)	\??\a:	server.exe
File opened (read-only)	\??\n:	server.exe
File opened (read-only)	\??\k:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\m:	server.exe
File opened (read-only)	\??\q:	server.exe
File opened (read-only)	\??\t:	server.exe
File opened (read-only)	\??\x:	server.exe
File opened (read-only)	\??\s:	svzhost.exe
File opened (read-only)	\??\j:	server.exe
File opened (read-only)	\??\p:	server.exe
File opened (read-only)	\??\m:	svzhost.exe
File opened (read-only)	\??\p:	svzhost.exe
File opened (read-only)	\??\j:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\w:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\z:	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
File opened (read-only)	\??\f:	svzhost.exe
File opened (read-only)	\??\h:	svzhost.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2044-56-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/2044-62-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/2044-68-0x00000000038D0000-0x00000000039B5000-memory.dmp	autoit_exe
behavioral1/memory/1584-69-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/2044-77-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/1672-113-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/1760-134-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/1584-141-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/1672-151-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/1760-165-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

svzhost.exesvzhost.exe

description	pid	process	target process
PID 1584 set thread context of 1508	1584	svzhost.exe	svzhost.exe
PID 1584 set thread context of 536	1584	svzhost.exe	svzhost.exe
PID 1760 set thread context of 980	1760	svzhost.exe	svzhost.exe
PID 1760 set thread context of 1740	1760	svzhost.exe	svzhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Gathers network information 2 TTPs 8 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exe

pid process

1672 ipconfig.exe
1908 ipconfig.exe
1668 ipconfig.exe
1736 ipconfig.exe
468 ipconfig.exe
284 ipconfig.exe
2044 ipconfig.exe
1980 ipconfig.exe

pid	process
1672	ipconfig.exe
1908	ipconfig.exe
1668	ipconfig.exe
1736	ipconfig.exe
468	ipconfig.exe
284	ipconfig.exe
2044	ipconfig.exe
1980	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

svzhost.exesvzhost.exe

pid	process
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1584	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe
1760	svzhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svzhost.exe

pid process

1012 svzhost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svzhost.exe

description pid process

Token: SeDebugPrivilege 1012 svzhost.exe
Token: SeDebugPrivilege 1012 svzhost.exe

pid	process
1012	svzhost.exe

description	pid	process
Token: SeDebugPrivilege	1012	svzhost.exe
Token: SeDebugPrivilege	1012	svzhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.execmd.execmd.exesvzhost.execmd.execmd.exesvzhost.exe

description	pid	process	target process
PID 2044 wrote to memory of 972	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	cmd.exe
PID 2044 wrote to memory of 972	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	cmd.exe
PID 2044 wrote to memory of 972	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	cmd.exe
PID 2044 wrote to memory of 972	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	cmd.exe
PID 972 wrote to memory of 1672	972	cmd.exe	ipconfig.exe
PID 972 wrote to memory of 1672	972	cmd.exe	ipconfig.exe
PID 972 wrote to memory of 1672	972	cmd.exe	ipconfig.exe
PID 972 wrote to memory of 1672	972	cmd.exe	ipconfig.exe
PID 2044 wrote to memory of 1056	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	cmd.exe
PID 2044 wrote to memory of 1056	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	cmd.exe
PID 2044 wrote to memory of 1056	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	cmd.exe
PID 2044 wrote to memory of 1056	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	cmd.exe
PID 1056 wrote to memory of 1908	1056	cmd.exe	ipconfig.exe
PID 1056 wrote to memory of 1908	1056	cmd.exe	ipconfig.exe
PID 1056 wrote to memory of 1908	1056	cmd.exe	ipconfig.exe
PID 1056 wrote to memory of 1908	1056	cmd.exe	ipconfig.exe
PID 2044 wrote to memory of 1584	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	svzhost.exe
PID 2044 wrote to memory of 1584	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	svzhost.exe
PID 2044 wrote to memory of 1584	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	svzhost.exe
PID 2044 wrote to memory of 1584	2044	815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe	svzhost.exe
PID 1584 wrote to memory of 1912	1584	svzhost.exe	cmd.exe
PID 1584 wrote to memory of 1912	1584	svzhost.exe	cmd.exe
PID 1584 wrote to memory of 1912	1584	svzhost.exe	cmd.exe
PID 1584 wrote to memory of 1912	1584	svzhost.exe	cmd.exe
PID 1912 wrote to memory of 1668	1912	cmd.exe	ipconfig.exe
PID 1912 wrote to memory of 1668	1912	cmd.exe	ipconfig.exe
PID 1912 wrote to memory of 1668	1912	cmd.exe	ipconfig.exe
PID 1912 wrote to memory of 1668	1912	cmd.exe	ipconfig.exe
PID 1584 wrote to memory of 1724	1584	svzhost.exe	cmd.exe
PID 1584 wrote to memory of 1724	1584	svzhost.exe	cmd.exe
PID 1584 wrote to memory of 1724	1584	svzhost.exe	cmd.exe
PID 1584 wrote to memory of 1724	1584	svzhost.exe	cmd.exe
PID 1724 wrote to memory of 1736	1724	cmd.exe	ipconfig.exe
PID 1724 wrote to memory of 1736	1724	cmd.exe	ipconfig.exe
PID 1724 wrote to memory of 1736	1724	cmd.exe	ipconfig.exe
PID 1724 wrote to memory of 1736	1724	cmd.exe	ipconfig.exe
PID 1584 wrote to memory of 1508	1584	svzhost.exe	svzhost.exe
PID 1584 wrote to memory of 1508	1584	svzhost.exe	svzhost.exe
PID 1584 wrote to memory of 1508	1584	svzhost.exe	svzhost.exe
PID 1584 wrote to memory of 1508	1584	svzhost.exe	svzhost.exe
PID 1584 wrote to memory of 1508	1584	svzhost.exe	svzhost.exe
PID 1584 wrote to memory of 1508	1584	svzhost.exe	svzhost.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe
PID 1508 wrote to memory of 1616	1508	svzhost.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe
"C:\Users\Admin\AppData\Local\Temp\815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C ipconfig /flushdns
2⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:1672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C ipconfig /flushdns
2⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:1908

C:\Users\Admin\AppData\Roaming\svzhost.exe
C:\Users\Admin\AppData\Roaming\svzhost.exe
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C ipconfig /flushdns
3⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
4⤵
- Gathers network information
PID:1668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C ipconfig /flushdns
3⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
4⤵
- Gathers network information
PID:1736

C:\Users\Admin\AppData\Roaming\svzhost.exe
"C:\Users\Admin\AppData\Roaming\svzhost.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Suspicious use of WriteProcessMemory
PID:1508

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1616

C:\Users\Admin\AppData\Roaming\svzhost.exe
"C:\Users\Admin\AppData\Roaming\svzhost.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\directory\CyberGate\install\server.exe
"C:\directory\CyberGate\install\server.exe"
5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
PID:1672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C ipconfig /flushdns
6⤵
PID:1400

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
7⤵
- Gathers network information
PID:468

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C ipconfig /flushdns
6⤵
PID:1364

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
7⤵
- Gathers network information
PID:284

C:\Users\Admin\AppData\Roaming\svzhost.exe
C:\Users\Admin\AppData\Roaming\svzhost.exe
6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C ipconfig /flushdns
7⤵
PID:1556

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
8⤵
- Gathers network information
PID:2044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C ipconfig /flushdns
7⤵
PID:1976

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
8⤵
- Gathers network information
PID:1980

C:\Users\Admin\AppData\Roaming\svzhost.exe
"C:\Users\Admin\AppData\Roaming\svzhost.exe"
7⤵
- Executes dropped EXE
PID:980

C:\Users\Admin\AppData\Roaming\svzhost.exe
"C:\Users\Admin\AppData\Roaming\svzhost.exe"
7⤵
- Executes dropped EXE
PID:1740

C:\Users\Admin\AppData\Roaming\svzhost.exe
"C:\Users\Admin\AppData\Roaming\svzhost.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
222KB

MD5
550521ce5ba350ce99d58374af03c63d

SHA1
6e7d81228d5d4cf44b75155300ddf2240062da15

SHA256
6798037a33eccaffe4e8515388019ee992345238b84c78b37eda0f770d31feba

SHA512
86a63c10b9673e34774bac960bd15d70e756e8fd42f98ac4b1178b151004bb96f3e222f342c3e5f316ee35357dec6f5a57d228185283235babaad480726cd0bd

Download Submit
C:\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
9b71207872dbbfb3984cb57044abe52d

SHA1
b512b2c02879f5d5941e17792610129f1b7472fe

SHA256
27798836cb4f45f83d5f4d6d803ba85fdd37ff09df034a11145089ea5ed6ad6e

SHA512
0df692714a1ed3956f7fcc62cd9aae0fb61aab0d4950bbe03b651395bc0bbf857378979372f389c7de79e6cbcc9fe8a446f986ffdc6161762580b0b43221c370

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
fd69dad4fad066cf3a0473284811838b

SHA1
1d4b03450f8275002c1ab73bb04d324ea03c1cb4

SHA256
64d405dba5ec60265b8828bbd670c7abb741b5cee0cc6007e89163df5fdfe08d

SHA512
4f63e044d0df24a24b913e264476b2999792c0e5d4be73ea2766d81a25aa7e7bc9f6055a1baaa03c1e6f970a63577c28c27dd16368dd93e8fb1e940f55994411

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
5629a402bc6bf921087b479738c25ca9

SHA1
4c4c4f1aa313b2a5ae856722010cd88baf4c6be6

SHA256
c023fba5f54e63cb099d948f2213fe2578c352d4096d3924d5b460ceac0bcea7

SHA512
e95fcf29f7a8c7a46340e087e0ae6bb119c1bbebd8e96aabf0b516c4799726e37c28e98fa6d32bb2192ab35bf430f01b248befa74e820a84f4f62f2ea1630fb8

Download Submit
C:\directory\CyberGate\install\server.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
C:\directory\CyberGate\install\server.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
\Users\Admin\AppData\Roaming\svzhost.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
\directory\CyberGate\install\server.exe
Filesize
1.0MB

MD5
501beaec545972571ca743ff468cae5b

SHA1
4e8b4f91d4e5eed8c6ff4632ffcf2d5feb2aeb8c

SHA256
815fa7b14be7c747ef6574e5c8bb6519f5177111b47b2d5a20709d10aeaf90b6

SHA512
2f9d2faead9b2f4a872bd0ce107e1e9cae657ce2d3333545198c04b748269cfcd056d42d41fd5e587a67fc0b6b00a8fc3d305c1c7061cb98a0656755b04dee6a

Download Submit
memory/284-118-0x0000000000000000-mapping.dmp

Download
memory/468-112-0x0000000000000000-mapping.dmp

Download
memory/536-123-0x000000000041F960-mapping.dmp

Download
memory/536-128-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/536-122-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/536-129-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/536-120-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/536-164-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/536-127-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/972-55-0x0000000000000000-mapping.dmp

Download
memory/980-162-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/980-145-0x00000000000CBBCC-mapping.dmp

Download
memory/980-149-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/980-150-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/1012-93-0x0000000000000000-mapping.dmp

Download
memory/1012-114-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/1012-100-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/1012-111-0x0000000009B40000-0x0000000009C25000-memory.dmp

Filesize
916KB

Download
memory/1012-102-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/1012-96-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1012-163-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/1056-59-0x0000000000000000-mapping.dmp

Download
memory/1364-117-0x0000000000000000-mapping.dmp

Download
memory/1400-110-0x0000000000000000-mapping.dmp

Download
memory/1508-80-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/1508-81-0x00000000000CBBCC-mapping.dmp

Download
memory/1508-103-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/1508-78-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/1508-97-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/1508-89-0x0000000010410000-0x0000000010471000-memory.dmp

Filesize
388KB

Download
memory/1508-86-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1508-87-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/1508-85-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/1508-83-0x00000000000C0000-0x000000000010E000-memory.dmp

Filesize
312KB

Download
memory/1556-133-0x0000000000000000-mapping.dmp

Download
memory/1584-64-0x0000000000000000-mapping.dmp

Download
memory/1584-69-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1584-141-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1668-71-0x0000000000000000-mapping.dmp

Download
memory/1672-107-0x0000000000000000-mapping.dmp

Download
memory/1672-151-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1672-57-0x0000000000000000-mapping.dmp

Download
memory/1672-113-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1724-74-0x0000000000000000-mapping.dmp

Download
memory/1736-75-0x0000000000000000-mapping.dmp

Download
memory/1740-161-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1740-155-0x000000000041F960-mapping.dmp

Download
memory/1760-165-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1760-134-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1760-130-0x0000000000000000-mapping.dmp

Download
memory/1908-60-0x0000000000000000-mapping.dmp

Download
memory/1912-70-0x0000000000000000-mapping.dmp

Download
memory/1976-138-0x0000000000000000-mapping.dmp

Download
memory/1980-139-0x0000000000000000-mapping.dmp

Download
memory/2044-68-0x00000000038D0000-0x00000000039B5000-memory.dmp

Filesize
916KB

Download
memory/2044-62-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2044-77-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2044-56-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2044-135-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download