cybergate | cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c

Analysis

max time kernel
151s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 13:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Size

281KB
MD5

7e1a3e174d3103017b12bcdea7363e4c
SHA1

855c22ab4640fda2ebd33116fdb1d3b759d28225
SHA256

cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c
SHA512

08a0be4f1d11ab30bbc778d9e569c6717f4c2fcbf9508824ae2490cfbae74b6409816681de488b1de7c11f781b049a48896f53a2c7da2ea1357e72b298045b46
SSDEEP

6144:gScrLq4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijm:xcFy78QSVnNyhsFMCeSjm

Score

10^/10

cybergate remote persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Trial version

Botnet

remote

127.0.0.1:81

user11ghost.no-ip.org:81

Mutex

I706F3Q812147A

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote anywhere in the world.
message_box_title
Windows
password
cybergate
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{V2KE357A-C2UL-2X05-1CWL-H6ELM500L2W6}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{V2KE357A-C2UL-2X05-1CWL-H6ELM500L2W6}	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{V2KE357A-C2UL-2X05-1CWL-H6ELM500L2W6}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{V2KE357A-C2UL-2X05-1CWL-H6ELM500L2W6}	explorer.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/848-55-0x0000000010410000-0x0000000010482000-memory.dmp	upx
behavioral1/memory/848-64-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral1/memory/2028-69-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral1/memory/2028-70-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral1/memory/848-74-0x0000000010510000-0x0000000010582000-memory.dmp	upx
behavioral1/memory/848-80-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral1/memory/804-85-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral1/memory/804-86-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral1/memory/2028-87-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral1/memory/804-88-0x0000000010590000-0x0000000010602000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\server.exe	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
File opened for modification	C:\Windows\SysWOW64\install\	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
File created	C:\Windows\SysWOW64\install\server.exe	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
804	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	2028	explorer.exe
Token: SeRestorePrivilege	2028	explorer.exe
Token: SeBackupPrivilege	804	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Token: SeRestorePrivilege	804	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Token: SeDebugPrivilege	804	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
Token: SeDebugPrivilege	804	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6
PID 848 wrote to memory of 1208	848	cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe	6

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
  "C:\Users\Admin\AppData\Local\Temp\cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe
    "C:\Users\Admin\AppData\Local\Temp\cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
236KB

MD5
3cb4f391c5a0e56c335b5b599c48c9df

SHA1
332f1cba8adeccba04ec9a65b998381dfab3b537

SHA256
b8c5c16189560a7023646a7a0d6d88498c36e6ab8cd9dada93eb04589fddf2f7

SHA512
be7c90721a50915a04648e323d605b0b721752f785d32aa7d5c00752bb8cc5f2a9bbff50d6d29bb8f97cfb5736ea223b3b4ec84f5cfb149d1f37a4170c7af7dc

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
281KB

MD5
7e1a3e174d3103017b12bcdea7363e4c

SHA1
855c22ab4640fda2ebd33116fdb1d3b759d28225

SHA256
cac79a20fec9134807ef44260f8168a3cf85411ffac9fdb8b85763b4ae9a461c

SHA512
08a0be4f1d11ab30bbc778d9e569c6717f4c2fcbf9508824ae2490cfbae74b6409816681de488b1de7c11f781b049a48896f53a2c7da2ea1357e72b298045b46

Download Submit
memory/804-88-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/804-86-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/804-85-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/848-80-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/848-64-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/848-74-0x0000000010510000-0x0000000010582000-memory.dmp

Filesize
456KB

Download
memory/848-55-0x0000000010410000-0x0000000010482000-memory.dmp

Filesize
456KB

Download
memory/1208-58-0x0000000010410000-0x0000000010482000-memory.dmp

Filesize
456KB

Download
memory/2028-70-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/2028-69-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/2028-63-0x00000000749D1000-0x00000000749D3000-memory.dmp

Filesize
8KB

Download
memory/2028-62-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/2028-87-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download