Malware Analysis Report

2025-01-02 13:07

Sample ID 240317-vgtygsag76
Target d165b46a9e1c246d4a4baf42df929a1f
SHA256 cab071ff985db9c1a64038ad4205eace92483039c90b7993f3ead4a47d8e3954
Tags
cybergate persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cab071ff985db9c1a64038ad4205eace92483039c90b7993f3ead4a47d8e3954

Threat Level: Known bad

The file d165b46a9e1c246d4a4baf42df929a1f was found to be: Known bad.

Malicious Activity Summary

cybergate persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Modifies Installed Components in the registry

UPX packed file

Drops file in System32 directory

Unsigned PE

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-17 16:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-17 16:58

Reported

2024-03-17 17:00

Platform

win7-20240221-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe

"C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe"

Network

N/A

Files

memory/2024-0-0x0000000000400000-0x000000000046E000-memory.dmp

C:\ProgramData\jI82l\PCGWIN32.LI5

MD5 c338cb71b993c4351a36df00dbd9f948
SHA1 c81db72e1c07a11903eb371edb2c0011a00df2d3
SHA256 47e1fb93598b36b1c0e15333e5310720333dcc6452fe86c722517d66307ed21d
SHA512 d983afae29b8cf4de16f36eaa4cffcab269b32fb43e3b57881f2c68655ef4574722a3e9097e19e0f305f0ea87818aa16e330337e5378e124c175fd6d4a553445

memory/2024-12-0x0000000000400000-0x000000000046E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-17 16:58

Reported

2024-03-17 17:00

Platform

win10v2004-20240226-en

Max time kernel

139s

Max time network

129s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe" C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe" C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe Restart" C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\windows\SysWOW64\microsoft\windows.exe C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A
File opened for modification \??\c:\windows\SysWOW64\microsoft\windows.exe C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE
PID 2592 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe

"C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5112 -ip 5112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 844

C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe

"C:\Users\Admin\AppData\Local\Temp\d165b46a9e1c246d4a4baf42df929a1f.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3248 -ip 3248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 524

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 198.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/2592-0-0x0000000000400000-0x000000000046E000-memory.dmp

C:\ProgramData\jI82l\PCGWIN32.LI5

MD5 9730a06a497856794393d416a6701e90
SHA1 bfe1087520d1a4dc3bf2a8760b4c7a1b42069ced
SHA256 adf31cb359a8521fdb89f3e75ea558542d6e26e86fbfef37e83f2d03382d4812
SHA512 a940a035c58059af164ce745fd845ae5164bba600bae3fd098cc83e3fc89d25b117dcf764aa67852407993e62639822dab4ea159f7c79073eed7bff579972243

memory/2592-15-0x0000000024010000-0x0000000024072000-memory.dmp

memory/5112-19-0x0000000000F10000-0x0000000000F11000-memory.dmp

memory/5112-20-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

memory/2592-75-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/5112-78-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

memory/5112-79-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/3248-105-0x0000000000400000-0x000000000046E000-memory.dmp

memory/3248-164-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/2592-165-0x0000000000400000-0x000000000046E000-memory.dmp