cybergate | a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197

General

Target

a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe
Size

998KB
MD5

0f7bdb2b2971d65a29d95f6dad890b26
SHA1

61abd6ab84c553b51c057c59cee2ca18f7f0aa55
SHA256

a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197
SHA512

b8befa82612739189f6375c3c33563807c4a3dc31f92d75e027797e7b7a8886b9f317929ab58a4b0283393e759813f84cb246b01958a4e9bf6262d7efcc16c69
SSDEEP

12288:T7bE7bcTQN5qP2YGmmBNuBp0lIUeVM9Q4IzBfA70eiGLc4FhtiaxhQRtz84CnFlS:AJuaY4YI9hWt3g17w2vw6CaMtnESb

Score

10^/10

cybergate victime persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

Victime

C2

5.61.173.192:3737

Mutex

87P0B8CJ1E5N37

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
falcon
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe

Executes dropped EXE 2 IoCs

Processes:

server.exeserver.exe

pid process

608 server.exe
1344 server.exe

pid	process
608	server.exe
1344	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1K3S0E43-7WAD-72OI-2QR2-MPYNESGED166}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1K3S0E43-7WAD-72OI-2QR2-MPYNESGED166}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1K3S0E43-7WAD-72OI-2QR2-MPYNESGED166}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1K3S0E43-7WAD-72OI-2QR2-MPYNESGED166}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1348-73-0x0000000010410000-0x0000000010471000-memory.dmp	upx
behavioral1/memory/1348-82-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral1/memory/812-87-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral1/memory/812-90-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral1/memory/1348-95-0x00000000104F0000-0x0000000010551000-memory.dmp	upx
behavioral1/memory/1176-100-0x00000000104F0000-0x0000000010551000-memory.dmp	upx
behavioral1/memory/1176-102-0x00000000104F0000-0x0000000010551000-memory.dmp	upx
behavioral1/memory/1176-109-0x00000000104F0000-0x0000000010551000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

explorer.exeexplorer.exe

pid process

1176 explorer.exe
812 explorer.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1176	explorer.exe
812	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe

Drops file in System32 directory 2 IoCs

Processes:

vbc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\install\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe

description	pid	process	target process
PID 1732 set thread context of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe

Drops file in Windows directory 1 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe explorer.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

vbc.exe

pid process

1348 vbc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1176 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 1176 explorer.exe
Token: SeDebugPrivilege 1176 explorer.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

vbc.exe

pid process

1348 vbc.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	explorer.exe

pid	process
1348	vbc.exe

pid	process
1176	explorer.exe

description	pid	process
Token: SeDebugPrivilege	1176	explorer.exe
Token: SeDebugPrivilege	1176	explorer.exe

pid	process
1348	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exevbc.exe

description	pid	process	target process
PID 1732 wrote to memory of 1992	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1992	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1992	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1992	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1732 wrote to memory of 1348	1732	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE
PID 1348 wrote to memory of 1268	1348	vbc.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe
"C:\Users\Admin\AppData\Local\Temp\a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
3⤵
PID:1992

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
PID:812

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\system32\install\server.exe"
5⤵
- Executes dropped EXE
PID:1344

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\system32\install\server.exe"
5⤵
- Executes dropped EXE
PID:608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
222KB

MD5
589cf70c6e5642b604753c15072927df

SHA1
ceff0f45c764cd5d246c8bea26bb10e035bf18cb

SHA256
96670cabc11b58b395d0629dba6cf2cae4f626f8bed8cee14f07471914bd5cc1

SHA512
b452b422098436fc6b23e7435ca135d92054521721e477d8f8a3a5bbee6ca1b2c4349038bb0cd77b9d56f8dfd5d38810201973f1cae3ba756bf0542a4c8eff80

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Windows\SysWOW64\install\server.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Windows\SysWOW64\install\server.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/608-106-0x0000000000000000-mapping.dmp

Download
memory/812-90-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/812-79-0x0000000000000000-mapping.dmp

Download
memory/812-87-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/812-81-0x00000000745A1000-0x00000000745A3000-memory.dmp

Filesize
8KB

Download
memory/1176-102-0x00000000104F0000-0x0000000010551000-memory.dmp

Filesize
388KB

Download
memory/1176-100-0x00000000104F0000-0x0000000010551000-memory.dmp

Filesize
388KB

Download
memory/1176-92-0x0000000000000000-mapping.dmp

Download
memory/1176-109-0x00000000104F0000-0x0000000010551000-memory.dmp

Filesize
388KB

Download
memory/1268-76-0x0000000010410000-0x0000000010471000-memory.dmp

Filesize
388KB

Download
memory/1344-105-0x0000000000000000-mapping.dmp

Download
memory/1348-66-0x000000000040BBCC-mapping.dmp

Download
memory/1348-65-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-82-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/1348-71-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-70-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-73-0x0000000010410000-0x0000000010471000-memory.dmp

Filesize
388KB

Download
memory/1348-67-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-57-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-95-0x00000000104F0000-0x0000000010551000-memory.dmp

Filesize
388KB

Download
memory/1348-56-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-101-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-59-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-63-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-61-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-62-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1348-60-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1732-68-0x0000000073E20000-0x00000000743CB000-memory.dmp

Filesize
5.7MB

Download
memory/1732-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1732-55-0x0000000073E20000-0x00000000743CB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads