cybergate | a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197

General

Target

a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe
Size

998KB
MD5

0f7bdb2b2971d65a29d95f6dad890b26
SHA1

61abd6ab84c553b51c057c59cee2ca18f7f0aa55
SHA256

a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197
SHA512

b8befa82612739189f6375c3c33563807c4a3dc31f92d75e027797e7b7a8886b9f317929ab58a4b0283393e759813f84cb246b01958a4e9bf6262d7efcc16c69
SSDEEP

12288:T7bE7bcTQN5qP2YGmmBNuBp0lIUeVM9Q4IzBfA70eiGLc4FhtiaxhQRtz84CnFlS:AJuaY4YI9hWt3g17w2vw6CaMtnESb

Score

10^/10

cybergate victime persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

Victime

C2

5.61.173.192:3737

Mutex

87P0B8CJ1E5N37

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
falcon
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1K3S0E43-7WAD-72OI-2QR2-MPYNESGED166}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1K3S0E43-7WAD-72OI-2QR2-MPYNESGED166}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	vbc.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1864-140-0x0000000010410000-0x0000000010471000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	vbc.exe

Drops file in System32 directory 2 IoCs

Processes:

vbc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\install\server.exe	vbc.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe

description pid process target process

PID 492 set thread context of 1864 492 a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe vbc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

1864 vbc.exe
1864 vbc.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

vbc.exe

pid process

1864 vbc.exe

description	pid	process	target process
PID 492 set thread context of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe

pid	process
1864	vbc.exe
1864	vbc.exe

pid	process
1864	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exevbc.exe

description	pid	process	target process
PID 492 wrote to memory of 2404	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 2404	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 2404	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 492 wrote to memory of 1864	492	a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe	vbc.exe
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE
PID 1864 wrote to memory of 792	1864	vbc.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:792

C:\Users\Admin\AppData\Local\Temp\a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe
"C:\Users\Admin\AppData\Local\Temp\a404f6cf445abac1cfe5a652849c20589247f06f68c53f46c9083046cf21e197.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
3⤵
PID:2404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:4152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-132-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/492-136-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/492-138-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/1864-133-0x0000000000000000-mapping.dmp

Download
memory/1864-134-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1864-135-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1864-137-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1864-140-0x0000000010410000-0x0000000010471000-memory.dmp

Filesize
388KB

Download
memory/4152-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads