cybergate | fe5c14753c1d5b8bc2a94852560e261728243a22b83198125a2df40a95d7954d

General

Target

Logiciel.exe
Size

898KB
MD5

45bf9ee48da640b917ff46f33703f536
SHA1

345ec16b5130fd1294cc7426023275e09ab8aea0
SHA256

cbd7f4aac14369eeb672432552a68f30f9dd0ad4e96171ad31d00f23938838b1
SHA512

eb8e4de02375f6cd51b07a9276eca969bcc9a258cc1ed5ec45834bd74bd8f4378666dd805b70b3fbe1741dd0f6509ce6f5420db914ef868d60c4bacd00968458
SSDEEP

12288:dH7Wcjdc/r2sxxiPGGAOOPSXDV8ClgVYhX5FSsf8QlufQFbGdNHQ1Gs3l4mMWfgB:dbCj2sObHtqQ4QluIGdNQbl4mMWfgB

Score

10^/10

cybergate hack persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

hack

C2

byehack.no-ip.org:1213

Mutex

O5B3J57T8A0OL2

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
1235

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

Logiciel.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "%AppData%\\plugin-container.exe,explorer.exe"	Logiciel.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Logiciel.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Logiciel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Flash Player = "%AppData%\\plugin-container.exe"	Logiciel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\svchost.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\svchost.exe"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R0658TQR-J710-K8G2-715X-8DPSHL47VB6A}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R0658TQR-J710-K8G2-715X-8DPSHL47VB6A}\StubPath = "C:\\Windows\\SysWOW64\\svchost.exe"	explorer.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3004-133-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/3004-135-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/3004-136-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/3004-137-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/3004-139-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/3004-144-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4212-147-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4212-148-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/3004-152-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/3004-156-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral2/memory/2524-155-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/2524-157-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/4212-159-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2524-160-0x00000000104F0000-0x0000000010555000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Logiciel.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	Logiciel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Flash Player = "%AppData%\\plugin-container.exe"	Logiciel.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Logiciel.exe

description pid process target process

PID 3096 set thread context of 3004 3096 Logiciel.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svchost.exe

pid process

2524 svchost.exe

description	pid	process	target process
PID 3096 set thread context of 3004	3096	Logiciel.exe	svchost.exe

pid	process
2524	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

explorer.exesvchost.exe

description	pid	process
Token: SeBackupPrivilege	4212	explorer.exe
Token: SeRestorePrivilege	4212	explorer.exe
Token: SeBackupPrivilege	2524	svchost.exe
Token: SeRestorePrivilege	2524	svchost.exe
Token: SeDebugPrivilege	2524	svchost.exe
Token: SeDebugPrivilege	2524	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Logiciel.exesvchost.exe

pid process

3096 Logiciel.exe
3096 Logiciel.exe
3096 Logiciel.exe
3004 svchost.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Logiciel.exe

pid process

3096 Logiciel.exe
3096 Logiciel.exe
3096 Logiciel.exe

pid	process
3096	Logiciel.exe
3096	Logiciel.exe
3096	Logiciel.exe
3004	svchost.exe

pid	process
3096	Logiciel.exe
3096	Logiciel.exe
3096	Logiciel.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Logiciel.exesvchost.exe

description	pid	process	target process
PID 3096 wrote to memory of 3004	3096	Logiciel.exe	svchost.exe
PID 3096 wrote to memory of 3004	3096	Logiciel.exe	svchost.exe
PID 3096 wrote to memory of 3004	3096	Logiciel.exe	svchost.exe
PID 3096 wrote to memory of 3004	3096	Logiciel.exe	svchost.exe
PID 3096 wrote to memory of 3004	3096	Logiciel.exe	svchost.exe
PID 3096 wrote to memory of 3004	3096	Logiciel.exe	svchost.exe
PID 3096 wrote to memory of 3004	3096	Logiciel.exe	svchost.exe
PID 3096 wrote to memory of 3004	3096	Logiciel.exe	svchost.exe
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE
PID 3004 wrote to memory of 3052	3004	svchost.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3052

C:\Users\Admin\AppData\Local\Temp\Logiciel.exe
"C:\Users\Admin\AppData\Local\Temp\Logiciel.exe"
2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
5⤵
PID:3372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
224KB

MD5
bc45f034f9dd7d496d20d4fe7464aed9

SHA1
d5086e2369e5998e283cbfcfac0d653ad8ee2867

SHA256
ccc50c463f561ad927ca949b4928005dd949766dc56e7ab9e6f0a94768948371

SHA512
e8da065e6549276f45a6e0b885b036168f6f073f263767dcb11fd44dcb7c7c25adead645eae5f7f8da7ff505dd0e74e5e37cce4b986f7cba16ce52cf97bd3d0f

Download Submit
memory/2524-160-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/2524-157-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/2524-155-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/2524-151-0x0000000000000000-mapping.dmp

Download
memory/3004-152-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/3004-135-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3004-144-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/3004-133-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3004-136-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3004-139-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/3004-137-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3004-132-0x0000000000000000-mapping.dmp

Download
memory/3004-156-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3372-158-0x0000000000000000-mapping.dmp

Download
memory/4212-148-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/4212-143-0x0000000000000000-mapping.dmp

Download
memory/4212-159-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/4212-147-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads