cybergate | eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc

Analysis

max time kernel
201s
max time network
104s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe
Size

964KB
MD5

212f63815566096ceb1a25cf6679b089
SHA1

3b855f0e36532a2f6d1a2d2c073a119844d51c7d
SHA256

eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc
SHA512

f46f7908ed80cea9566cbe696f1f8d1608926236bef2d98d6c24d159d9a3c3c92e46e6faecc74fc079b81687003a2951f261af06a34b5082b37eb8801bd49fe2
SSDEEP

12288:gc/WcZp+fCI7HX2lnk8rlw9zK+fz9Bd0676X8WZ7PAh2MudR193OOj+FKcZ+DN4V:gc/W5HXsNmvPoNIyJLUTVr

Score

10^/10

cybergate opfer persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Opfer

monamona.zapto.org:83

Mutex

27GU7WNJ34LA67

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
updater123
install_file
update.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
hitler
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\updater123\\update.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\updater123\\update.exe"	vbc.exe

Executes dropped EXE 1 IoCs

pid	Process
1204	update.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y7YA53Y8-E536-R31X-2715-L8KN6PI1FBBQ}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y7YA53Y8-E536-R31X-2715-L8KN6PI1FBBQ}\StubPath = "C:\\Windows\\system32\\updater123\\update.exe Restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y7YA53Y8-E536-R31X-2715-L8KN6PI1FBBQ}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y7YA53Y8-E536-R31X-2715-L8KN6PI1FBBQ}\StubPath = "C:\\Windows\\system32\\updater123\\update.exe"	explorer.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1128-57-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1128-59-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1128-60-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1128-64-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1128-65-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1128-78-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1128-80-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral1/memory/1128-89-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1636-94-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1636-95-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1128-97-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral1/memory/1128-105-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1128-106-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1128-111-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1376-112-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1376-114-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1636-115-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1376-116-0x0000000010560000-0x00000000105C5000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1376	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\updater123\\update.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Testing = "C:\\ProgramData\\Svg64.exe"	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\updater123\\update.exe"	vbc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\updater123\update.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\updater123\update.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\updater123\update.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\updater123\	vbc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1884 set thread context of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 set thread context of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1128	vbc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1376	vbc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	1576	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1576	AUDIODG.EXE
Token: 33	1576	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1576	AUDIODG.EXE
Token: SeBackupPrivilege	1636	explorer.exe
Token: SeRestorePrivilege	1636	explorer.exe
Token: SeBackupPrivilege	1376	vbc.exe
Token: SeRestorePrivilege	1376	vbc.exe
Token: SeDebugPrivilege	1376	vbc.exe
Token: SeDebugPrivilege	1376	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1128	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 wrote to memory of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 wrote to memory of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 wrote to memory of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 wrote to memory of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 wrote to memory of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 wrote to memory of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 wrote to memory of 1128	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	28
PID 1884 wrote to memory of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29
PID 1884 wrote to memory of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29
PID 1884 wrote to memory of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29
PID 1884 wrote to memory of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29
PID 1884 wrote to memory of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29
PID 1884 wrote to memory of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29
PID 1884 wrote to memory of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29
PID 1884 wrote to memory of 520	1884	eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe	29
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8
PID 1128 wrote to memory of 1264	1128	vbc.exe	8

C:\Users\Admin\AppData\Local\Temp\eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe
"C:\Users\Admin\AppData\Local\Temp\eaa1276be96c5d09f12193d2afcccca94dd5715fa639d7f5ac471aa3ff8561cc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1648
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
  - - C:\Windows\SysWOW64\updater123\update.exe
      "C:\Windows\system32\updater123\update.exe"
      4⤵
      Executes dropped EXE
      PID:1204
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:520

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
432eae1aad248211ee35fddcbe723ae5

SHA1
6476bd49ec59a30c6d3892ddefc04d1dd71c9ba2

SHA256
f346e3cfc7a70263ce44b4c08c1c863ff094a58fdcf1205588d75f4d87b8be72

SHA512
892d6be71e7ed3880ebe6a6b31a01e5e51f8a5f4662d94f112884e7492232d44bf777bbdfa73ba735f6474df4f0f3e4d07b50bdc0e88495990d4670fe7579bc1

Download Submit
C:\Windows\SysWOW64\updater123\update.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Windows\SysWOW64\updater123\update.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Windows\SysWOW64\updater123\update.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/520-77-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/520-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/520-75-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/520-74-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/520-66-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/520-67-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/520-69-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/520-71-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1128-105-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-111-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-64-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-56-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-78-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-60-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-80-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1128-57-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-65-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-106-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1128-89-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1128-59-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1128-97-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/1264-83-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1376-112-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1376-116-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1376-114-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1636-115-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1636-88-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download
memory/1636-94-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1636-95-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1884-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1884-76-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download
memory/1884-55-0x0000000074A90000-0x000000007503B000-memory.dmp

Filesize
5.7MB

Download