cybergate | 35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

Analysis

max time kernel
59s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe
Size

524KB
MD5

2d66d5b6dbd25544368cba771513e858
SHA1

d64a8d21cd36657168e818dc7eeedff52aa86976
SHA256

35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4
SHA512

a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f
SSDEEP

12288:PV15wLR2ts0EXSoGGMKpMG7cIdV6yY/lNRT2Khdt6LkokUkkkkUeGWlpkkkk6kkp:PH8Rg9StGGjyK1dVjY/lNRCUhLLp

Score

10^/10

cybergate rpc gta persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

RPC GTA

94.102.53.192:1616

Mutex

56MM714CB7PJXN

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

Defender.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\MicrosoftServices\\MicrosoftServices\\Defender.exe"	Defender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\MicrosoftServices\\MicrosoftServices\\Defender.exe"	Defender.exe

Executes dropped EXE 2 IoCs

Processes:

Defender.execsrss.exe

pid process

1756 Defender.exe
1772 csrss.exe

pid	process
1756	Defender.exe
1772	csrss.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2012-99-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral1/memory/1056-104-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral1/memory/1056-106-0x0000000010410000-0x0000000010480000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exeDefender.exe

pid	process
364	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe
364	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe
1756	Defender.exe
1756	Defender.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Defender.exe

description pid process target process

PID 1756 set thread context of 2012 1756 Defender.exe AppLaunch.exe

description	pid	process	target process
PID 1756 set thread context of 2012	1756	Defender.exe	AppLaunch.exe

Drops file in Program Files directory 7 IoCs

Processes:

35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exeDefender.exe

description	ioc	process
File created	C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe
File opened for modification	C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe
File opened for modification	C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe	Defender.exe
File opened for modification	C:\Program Files (x86)\MicrosoftServices\	Defender.exe
File opened for modification	C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\	Defender.exe
File created	C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\csrss.exe	Defender.exe
File opened for modification	C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\csrss.exe	Defender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exeDefender.exe

pid process

364 35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe
1756 Defender.exe
1756 Defender.exe
1756 Defender.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exeDefender.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	364	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe
Token: SeDebugPrivilege	1756	Defender.exe
Token: SeDebugPrivilege	1756	Defender.exe
Token: SeDebugPrivilege	1056	AppLaunch.exe
Token: SeDebugPrivilege	1056	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exeDefender.exeAppLaunch.exe

description	pid	process	target process
PID 364 wrote to memory of 1756	364	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe	Defender.exe
PID 364 wrote to memory of 1756	364	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe	Defender.exe
PID 364 wrote to memory of 1756	364	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe	Defender.exe
PID 364 wrote to memory of 1756	364	35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe	Defender.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 2012	1756	Defender.exe	AppLaunch.exe
PID 1756 wrote to memory of 1772	1756	Defender.exe	csrss.exe
PID 1756 wrote to memory of 1772	1756	Defender.exe	csrss.exe
PID 1756 wrote to memory of 1772	1756	Defender.exe	csrss.exe
PID 1756 wrote to memory of 1772	1756	Defender.exe	csrss.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe
PID 2012 wrote to memory of 1056	2012	AppLaunch.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe
"C:\Users\Admin\AppData\Local\Temp\35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364

C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe
"C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\csrss.exe
"C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\csrss.exe" -keyhide -prochide 2012 -reg C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe -avkill-proc 2012 C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe
3⤵
- Executes dropped EXE
PID:1772

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe
Filesize
524KB

MD5
2d66d5b6dbd25544368cba771513e858

SHA1
d64a8d21cd36657168e818dc7eeedff52aa86976

SHA256
35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

SHA512
a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f

Download Submit
C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe
Filesize
524KB

MD5
2d66d5b6dbd25544368cba771513e858

SHA1
d64a8d21cd36657168e818dc7eeedff52aa86976

SHA256
35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

SHA512
a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f

Download Submit
C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\csrss.exe
Filesize
524KB

MD5
2d66d5b6dbd25544368cba771513e858

SHA1
d64a8d21cd36657168e818dc7eeedff52aa86976

SHA256
35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

SHA512
a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f

Download Submit
C:\Program Files (x86)\MicrosoftServices\MicrosoftServices\csrss.exe
Filesize
524KB

MD5
2d66d5b6dbd25544368cba771513e858

SHA1
d64a8d21cd36657168e818dc7eeedff52aa86976

SHA256
35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

SHA512
a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
234KB

MD5
be6c709b461180a89cca1ba71cf200fe

SHA1
40fc7fda2220f00609c73ad05d1235b891abf2ab

SHA256
cb2560aa344e9b0b96df9e3bced1516a562753d3b3e635367ab41d19b48c786e

SHA512
f96648a749d34af53082ead5373111c2f52a2b6a8b75f9620d5c24fae29ffb412b466b82cf9f322fc4309d6b15168416bfd00fe5ab49374eac2611e5593c33f3

Download Submit
\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe
Filesize
524KB

MD5
2d66d5b6dbd25544368cba771513e858

SHA1
d64a8d21cd36657168e818dc7eeedff52aa86976

SHA256
35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

SHA512
a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f

Download Submit
\Program Files (x86)\MicrosoftServices\MicrosoftServices\Defender.exe
Filesize
524KB

MD5
2d66d5b6dbd25544368cba771513e858

SHA1
d64a8d21cd36657168e818dc7eeedff52aa86976

SHA256
35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

SHA512
a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f

Download Submit
\Program Files (x86)\MicrosoftServices\MicrosoftServices\csrss.exe
Filesize
524KB

MD5
2d66d5b6dbd25544368cba771513e858

SHA1
d64a8d21cd36657168e818dc7eeedff52aa86976

SHA256
35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

SHA512
a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f

Download Submit
\Program Files (x86)\MicrosoftServices\MicrosoftServices\csrss.exe
Filesize
524KB

MD5
2d66d5b6dbd25544368cba771513e858

SHA1
d64a8d21cd36657168e818dc7eeedff52aa86976

SHA256
35cb0ceef3f5542a5c6f3e0585eb07c0041df4b695ac92834b621c549a733bc4

SHA512
a34d13da811bec4df06f26405b4542488db4719bf83fb4f7bf2c37e6c8e7e0fc03427f0e92235eca2a7e6b1a43d04dd2c73d0e9c14f0f0ed363497e3e0a4504f

Download Submit
memory/364-63-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/364-64-0x00000000020F6000-0x0000000002107000-memory.dmp

Filesize
68KB

Download
memory/364-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/364-56-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/364-55-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1056-106-0x0000000010410000-0x0000000010480000-memory.dmp

Filesize
448KB

Download
memory/1056-96-0x0000000000000000-mapping.dmp

Download
memory/1056-102-0x0000000010410000-0x0000000010480000-memory.dmp

Filesize
448KB

Download
memory/1056-104-0x0000000010410000-0x0000000010480000-memory.dmp

Filesize
448KB

Download
memory/1756-65-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-59-0x0000000000000000-mapping.dmp

Download
memory/1756-66-0x0000000000B46000-0x0000000000B57000-memory.dmp

Filesize
68KB

Download
memory/1756-67-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-94-0x0000000000B46000-0x0000000000B57000-memory.dmp

Filesize
68KB

Download
memory/1756-93-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1772-89-0x0000000000000000-mapping.dmp

Download
memory/1772-98-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/2012-83-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-77-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-74-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-86-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-73-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-72-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-85-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-75-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-71-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-81-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-99-0x0000000010410000-0x0000000010480000-memory.dmp

Filesize
448KB

Download
memory/2012-68-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-79-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2012-78-0x0000000000409860-mapping.dmp

Download
memory/2012-69-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads