cybergate | 51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50

Analysis

max time kernel
182s
max time network
231s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
Size 634KB
Sample221124-adaefsea99
SHA256 51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50
MD5 407834930ce5212f0f4b2c5deea60d45
SHA1 2bc8d03c7fcc3204b77c40da46b71cc2d9364d46
SHA512 b0587dfc1132a52ecd75f2922d2c18624a1302c383959944823ad082f728116e2919f2482b7f4e5b2571291fd984d71685d03c296467c94a94f563081d413993
SSDEEP 12288:IR5pmtkDK8VbW1wIbrioXBiiazq0hitU+iAh1kIkR4wW1NT1qQO:IPp0k2TbfiDzPiCskIcAAZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate bc persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v3.5.1.0

Botnet

kimolo.ddnsking.com:999

Mutex

1NAB7C2PBW4875

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
cleaner
install_file
cleaner.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Anzeige auf diesem Gerät nicht möglich!
message_box_title
FEHLER
password
CG8888
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4720-141-0x0000000010410000-0x0000000010481000-memory.dmp	upx
behavioral2/memory/4720-145-0x0000000010490000-0x0000000010501000-memory.dmp	upx
behavioral2/memory/4720-150-0x0000000010510000-0x0000000010581000-memory.dmp	upx
behavioral2/memory/4792-153-0x0000000010510000-0x0000000010581000-memory.dmp	upx
behavioral2/memory/4792-154-0x0000000010510000-0x0000000010581000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winx Update = "C:\\Users\\Admin\\AppData\\Roaming\\Winx Update\\Winx Update.exe"	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 set thread context of 2312	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	89
PID 4764 set thread context of 3064	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	90
PID 4764 set thread context of 2356	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	97
PID 4764 set thread context of 2412	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	98
PID 4764 set thread context of 3288	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	101
PID 4764 set thread context of 2808	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	103
PID 4764 set thread context of 3672	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	104

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
File created	C:\Windows\assembly\Desktop.ini	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
Token: SeDebugPrivilege	4792	explorer.exe
Token: SeDebugPrivilege	4792	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4720	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4764 wrote to memory of 4720	4764	51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe	85
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86
PID 4720 wrote to memory of 3048	4720	vbc.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2720
- C:\Users\Admin\AppData\Local\Temp\51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe
  "C:\Users\Admin\AppData\Local\Temp\51075acd6f0b4ee3e3a116f1aa266883abab5a48265190ddd55c5c023cd3bf50.exe"
  2⤵
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:2312
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:3064
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:2356
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:2412
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:3288
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:2808
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    PID:3672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Admin2.txt

Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Size 235KB
SHA256 159d4e3d6ec619d090c94adc1199203319c87e97b3357b608d1da3136a4bb0aa
MD5 72aa22bfbcac975e6cf4985160b898af
SHA1 2c40400886b5c71526143b072e5e2081bb538e85
SHA512 3fceb5d8740cca23ff16808bf268ba21acbed2f6d207146bbdca9eb69785d0cbfefd936228af4ca6d5c10ec1667ed8a337065e54461dbacb827830887c5e498b
SSDEEP 6144:Y2m7iH6k6A5O8iBvoCWA6/82o1Av2LSvVMoNOVk:Y2m7EsAg88F1A1MoNOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2312-162-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2312-161-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2356-174-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2356-173-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2412-180-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2412-179-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2808-192-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2808-191-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3064-168-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3064-167-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3288-185-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3288-186-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3672-197-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/3672-198-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4720-139-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4720-150-0x0000000010510000-0x0000000010581000-memory.dmp

Download

memory/4720-135-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4720-136-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4720-145-0x0000000010490000-0x0000000010501000-memory.dmp

Download

memory/4720-137-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4720-134-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4720-141-0x0000000010410000-0x0000000010481000-memory.dmp

Download

memory/4720-155-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4764-138-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/4764-132-0x00000000753A0000-0x0000000075951000-memory.dmp

Download

memory/4792-153-0x0000000010510000-0x0000000010581000-memory.dmp

Download

memory/4792-154-0x0000000010510000-0x0000000010581000-memory.dmp

Download