cybergate | 642c721e23350217dc4fc21777141d21e0751fe595b7dd7684fc6e97109682d1

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b4a0c7bc07c6d5bda6648fcf0fae785.exe
Size

762KB
MD5

4b4a0c7bc07c6d5bda6648fcf0fae785
SHA1

927a8538b9abaa52b80de538480205b43f7981d3
SHA256

642c721e23350217dc4fc21777141d21e0751fe595b7dd7684fc6e97109682d1
SHA512

933391585e7d02f6588055a24ba858ace3418e751efd773d642d910e939b916cadc561576a5b0832af2154575d7e1342cd99d7e6377fd16b2fe99d6e260e6910
SSDEEP

12288:5gftZIKarUdrNYIgXFtPBDftJjkPNFz6kNOijD2l4DRHKUNaGt:5mQTUdZYIgVpBDfbw6kNDDa4DhJt

Score

10^/10

cybergate tools persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Tools

127.0.0.1:81

jinidz.zapto.org:82

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
calc.exe
install_dir
Hkey
install_file
Sound.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Hkey\\Sound.exe"	860.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	860.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Hkey\\Sound.exe"	860.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{KC7Q31AI-0Q3K-6YR6-EQMY-128JQS8YY678}\StubPath = "C:\\Windows\\system32\\Hkey\\Sound.exe Restart"	860.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{KC7Q31AI-0Q3K-6YR6-EQMY-128JQS8YY678}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{KC7Q31AI-0Q3K-6YR6-EQMY-128JQS8YY678}\StubPath = "C:\\Windows\\system32\\Hkey\\Sound.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{KC7Q31AI-0Q3K-6YR6-EQMY-128JQS8YY678}	860.exe

Executes dropped EXE 3 IoCs

pid	Process
1672	860.exe
816	860.exe
1132	Sound.exe

Loads dropped DLL 3 IoCs

pid	Process
1672	860.exe
816	860.exe
816	860.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/640-535-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/816-836-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/640-1635-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/816-2078-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Hkey\\Sound.exe"	860.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Hkey\\Sound.exe"	860.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hkey\Sound.exe	860.exe
File opened for modification	C:\Windows\SysWOW64\Hkey\Sound.exe	860.exe
File opened for modification	C:\Windows\SysWOW64\Hkey\Sound.exe	860.exe
File opened for modification	C:\Windows\SysWOW64\Hkey\	860.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1672	860.exe
1672	860.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
816	860.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	860.exe
Token: SeDebugPrivilege	816	860.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	860.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1672	2108	4b4a0c7bc07c6d5bda6648fcf0fae785.exe	15
PID 2108 wrote to memory of 1672	2108	4b4a0c7bc07c6d5bda6648fcf0fae785.exe	15
PID 2108 wrote to memory of 1672	2108	4b4a0c7bc07c6d5bda6648fcf0fae785.exe	15
PID 2108 wrote to memory of 1672	2108	4b4a0c7bc07c6d5bda6648fcf0fae785.exe	15
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21
PID 1672 wrote to memory of 1200	1672	860.exe	21

C:\Users\Admin\AppData\Local\Temp\860.exe
C:\Users\Admin\AppData\Local\Temp\860.exe
1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Modifies Installed Components in the registry
  PID:640
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\860.exe
  "C:\Users\Admin\AppData\Local\Temp\860.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- - C:\Windows\SysWOW64\Hkey\Sound.exe
    "C:\Windows\system32\Hkey\Sound.exe"
    3⤵
    - Executes dropped EXE
    PID:1132

C:\Users\Admin\AppData\Local\Temp\4b4a0c7bc07c6d5bda6648fcf0fae785.exe
"C:\Users\Admin\AppData\Local\Temp\4b4a0c7bc07c6d5bda6648fcf0fae785.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\860.exe

Filesize
92KB

MD5
f1e5c3f06313d890228b6750e8ed3c2c

SHA1
680362a90379b9f03bfc75cd7bf1f3c57eefbd47

SHA256
2ce06e9c22ca4033cb17a83044145de0f2f9e5ebf276bc3d46676518f66e0f93

SHA512
56a08584f6be596e2bbe9b8858d645f7d53d688c0f7e6ddda5aa4bcdb98169d99c3b1d57db6ba068295b1c505b3d17e311101cf9cee20ad08bbd3da9880c5d26

Download Submit
memory/640-535-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/640-262-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/640-260-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/640-1635-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/816-836-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/816-2078-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1200-14-0x0000000003060000-0x0000000003061000-memory.dmp

Filesize
4KB

Download
memory/2108-9-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/2108-8-0x0000000002010000-0x0000000002090000-memory.dmp

Filesize
512KB

Download
memory/2108-1-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/2108-0-0x000000001B190000-0x000000001B29E000-memory.dmp

Filesize
1.1MB

Download
memory/2108-838-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download