cybergate | 02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020.exe
Size

287KB
MD5

90836c37324ef07af0c8a2fbbbcb43df
SHA1

3bcf740147ac242d80f03b9665988f9c54e9b2ce
SHA256

02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020
SHA512

85c7b07dfdbb43770bfc34069dc0ea17346b349a9f9b58d366fbf33ed1a171109d291017a9f75bd819c2a14e6a72679cc8aff9b1e9b5ac7c9bfaf89abfdfab94
SSDEEP

6144:dSD3sPwpUuuBsrVXUAvDmH5r/YVFKlc8RfMRoEY:oDsopimRUAvDmH5r/mclcEfMRk

Score

10^/10

cybergate remote persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

koolzone.no-ip.biz:2000

Mutex

X102C60DYD7IA4

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./victim/
ftp_interval
30
ftp_password
hiphop49
ftp_port
21
ftp_server
ftp.megastylesboutique.pusku.com
ftp_username
u642653441.bob
injected_process
explorer.exe
install_dir
install
install_file
firefoxexe
install_flag
true
keylogger_enable_ftp
true
message_box_caption
Error un fichier cidz.dl introuvable
message_box_title
Error
password
hiphop
regkey_hkcu
HKCU

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\firefoxexe"	server.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\firefoxexe"	server.exe

Executes dropped EXE 1 IoCs

pid	Process
1016	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7TVSY2JD-G851-6K64-UJ74-7EB8TLSBUV7Q}\StubPath = "C:\\Windows\\system32\\install\\firefoxexe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7TVSY2JD-G851-6K64-UJ74-7EB8TLSBUV7Q}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7TVSY2JD-G851-6K64-UJ74-7EB8TLSBUV7Q}\StubPath = "C:\\Windows\\system32\\install\\firefoxexe Restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7TVSY2JD-G851-6K64-UJ74-7EB8TLSBUV7Q}	explorer.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1016-136-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/1016-141-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/1932-144-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/1932-147-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/1016-150-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/2136-153-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/2136-154-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/2136-155-0x00000000104F0000-0x0000000010555000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\firefoxexe"	server.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\firefoxexe	server.exe
File opened for modification	C:\Windows\SysWOW64\install\firefoxexe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	server.exe
1016	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2136	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	1932	explorer.exe
Token: SeRestorePrivilege	1932	explorer.exe
Token: SeBackupPrivilege	2136	explorer.exe
Token: SeRestorePrivilege	2136	explorer.exe
Token: SeDebugPrivilege	2136	explorer.exe
Token: SeDebugPrivilege	2136	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1016	server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1168	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1016	2432	02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020.exe	80
PID 2432 wrote to memory of 1016	2432	02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020.exe	80
PID 2432 wrote to memory of 1016	2432	02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020.exe	80
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34
PID 1016 wrote to memory of 2560	1016	server.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2560
- C:\Users\Admin\AppData\Local\Temp\02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020.exe
  "C:\Users\Admin\AppData\Local\Temp\02dbd51e6e6665e1dbcee0114c837134c5e081e8d20b2f2cdec7dfe6d561d020.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      Suspicious use of AdjustPrivilegeToken
      PID:1932
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
3e34523330a6d6a7da32e6f6179b5467

SHA1
e174599463baa2f03af29814a47faf8b86082781

SHA256
d9ee0d25e487350e00675b8158ab80912b0a4bcfe407b38bf58fba3544c872af

SHA512
9d1e69348ab69ff1612aa7d8681dcd89e7b4286f666dc885cee8a9df0acf1230848f3ccf1bcae3600283fc1f33097be675b4e33b0c763111ab09317791b0447b

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
296KB

MD5
2e4e23a058cfc26ef55cdb5ed7a451f7

SHA1
8917ff4dab0234a0a6c57c71107dedf55f3f0142

SHA256
677cb5bbce93f4acd86295fae4d94f561e41b6fe19a92eb9c8f233523bcc1dbc

SHA512
7c29ee11bfc75463d01f2ca16753b54e51d8b6e2b083bd41b0097ca688828f5369245c864db3047fe93b285f5bb5b6033f8baca4e0c82e3da304f0bba67190b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
296KB

MD5
2e4e23a058cfc26ef55cdb5ed7a451f7

SHA1
8917ff4dab0234a0a6c57c71107dedf55f3f0142

SHA256
677cb5bbce93f4acd86295fae4d94f561e41b6fe19a92eb9c8f233523bcc1dbc

SHA512
7c29ee11bfc75463d01f2ca16753b54e51d8b6e2b083bd41b0097ca688828f5369245c864db3047fe93b285f5bb5b6033f8baca4e0c82e3da304f0bba67190b9

Download Submit
C:\Windows\SysWOW64\install\firefoxexe

Filesize
296KB

MD5
2e4e23a058cfc26ef55cdb5ed7a451f7

SHA1
8917ff4dab0234a0a6c57c71107dedf55f3f0142

SHA256
677cb5bbce93f4acd86295fae4d94f561e41b6fe19a92eb9c8f233523bcc1dbc

SHA512
7c29ee11bfc75463d01f2ca16753b54e51d8b6e2b083bd41b0097ca688828f5369245c864db3047fe93b285f5bb5b6033f8baca4e0c82e3da304f0bba67190b9

Download Submit
memory/1016-136-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1016-150-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/1016-141-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1932-144-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1932-147-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/2136-153-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/2136-154-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/2136-155-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download