cybergate | c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3

General

Target

c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe
Size

1.1MB
MD5

c3949d458a91786a6037188c6a098a8f
SHA1

eb029186b7a25cb6185106d06adcaa7e4061eefb
SHA256

c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3
SHA512

68b3c9779b5c49291503ec4f0e56e0c274274a64a35273348cd879cee5f4b16167b303fccf6a7c984f6f3c0ab9dea7e6d4362fb1f3324448780e0c13771be8f3
SSDEEP

12288:6o1IrQRfhmX01LiOCkKMdrJALYVcXmGdUq7nvr6MgSEr1ZixnzHh1ErnUbalmqvb:8qZmmrcX5js8nTmx9X2Hj4Z8P

Score

10^/10

cybergate victime persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

victime

C2

therealdexen.no-ip.biz:27015

Mutex

V13NYN68G86567

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
ftp_password
123lol
ftp_port
21
ftp_server
dexen.free.fr
ftp_username
dexen
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
true
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123lol

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbc.exe

Executes dropped EXE 2 IoCs

Processes:

server.exeserver.exe

pid process

2836 server.exe
4348 server.exe

pid	process
2836	server.exe
4348	server.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B21X7CH-WK45-EQH6-16B1-708U4HOY5XEG}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe Restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B21X7CH-WK45-EQH6-16B1-708U4HOY5XEG}	vbc.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1584-140-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/1584-145-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/956-148-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/956-151-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/956-157-0x0000000010480000-0x00000000104E5000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe

description pid process target process

PID 532 set thread context of 1584 532 c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe vbc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

1584 vbc.exe
1584 vbc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vbc.exe

pid process

956 vbc.exe

description	pid	process	target process
PID 532 set thread context of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe

pid	process
1584	vbc.exe
1584	vbc.exe

pid	process
956	vbc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeBackupPrivilege	956	vbc.exe
Token: SeRestorePrivilege	956	vbc.exe
Token: SeDebugPrivilege	956	vbc.exe
Token: SeDebugPrivilege	956	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exevbc.exe

description	pid	process	target process
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 532 wrote to memory of 1584	532	c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe	vbc.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe
PID 1584 wrote to memory of 3428	1584	vbc.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe
"C:\Users\Admin\AppData\Local\Temp\c076a611f9726ce59a6ab4472b69b68b30efc0ad8772db66a0a771a02cfa06e3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:3428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\directory\CyberGate\install\server.exe
"C:\directory\CyberGate\install\server.exe"
4⤵
- Executes dropped EXE
PID:4348

C:\directory\CyberGate\install\server.exe
"C:\directory\CyberGate\install\server.exe"
3⤵
- Executes dropped EXE
PID:2836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
224KB

MD5
1bfdd14ac661094727c98fe823df2d80

SHA1
3760cbc41ef0b817a80d1d8ccf355410fc8ddbbc

SHA256
4a926d10cfa069551ec48a6d15354239b7608438447a19211924a764c74f3edf

SHA512
39177a97ae8c41bae938a78576a506927119e37a818781373f079eb6c1bbee0f6ad3b61c2e578ed87b1f6430a1df887100618761202be742db0fcc6f68c032d2

Download Submit
C:\directory\CyberGate\install\server.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\directory\CyberGate\install\server.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\directory\CyberGate\install\server.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/532-137-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/532-132-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/956-148-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/956-157-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/956-151-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/956-144-0x0000000000000000-mapping.dmp

Download
memory/1584-136-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1584-145-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1584-135-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1584-140-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1584-134-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1584-156-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1584-133-0x0000000000000000-mapping.dmp

Download
memory/1584-138-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2836-152-0x0000000000000000-mapping.dmp

Download
memory/4348-153-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads