cybergate | c1d29284b6d4ae244712dd49661841b36a6de2387cad6ab55388b22769151878

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42BE3BED9261FBAE0A0AED767EBD88C0.exe
Size

202KB
MD5

42be3bed9261fbae0a0aed767ebd88c0
SHA1

6630748f26ac9e3a8d19cb43eeacd77d506b1808
SHA256

c1d29284b6d4ae244712dd49661841b36a6de2387cad6ab55388b22769151878
SHA512

bf522bb82bdee59a355043b0af17c42bf79b1d4e59120d3fb9ffcb96aad369d221b60af1106b29c51286a94d95ccfc80cc69421590c20a9984c73d61174a7c7b
SSDEEP

3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIGYcsD6RA5E3bKKiCf3e0kYrOV:QLV6Bta6dtJmakIM5gcs8A5ELiUfoZ

Score

10^/10

cybergate nanocore lammer evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Lammer

appdiscordgg.duckdns.org:81

appdiscordgg.duckdns.org:80

Mutex

Pluguin

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./
ftp_interval
30
injected_process
svchost.exe
install_dir
Microsoft
install_file
svchost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
message_box_title
LAMMER
password
123
regkey_hkcu
Microsoft
regkey_hklm
Microsoft

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

784 server.exe
Loads dropped DLL 2 IoCs

Processes:

42BE3BED9261FBAE0A0AED767EBD88C0.exe

pid process

1888 42BE3BED9261FBAE0A0AED767EBD88C0.exe
1888 42BE3BED9261FBAE0A0AED767EBD88C0.exe

pid	process
784	server.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

42BE3BED9261FBAE0A0AED767EBD88C0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	42BE3BED9261FBAE0A0AED767EBD88C0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

42BE3BED9261FBAE0A0AED767EBD88C0.exe

pid	process
1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe
1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe
1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe
1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

42BE3BED9261FBAE0A0AED767EBD88C0.exe

pid process

1888 42BE3BED9261FBAE0A0AED767EBD88C0.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

42BE3BED9261FBAE0A0AED767EBD88C0.exe

description pid process

Token: SeDebugPrivilege 1888 42BE3BED9261FBAE0A0AED767EBD88C0.exe

description	pid	process
Token: SeDebugPrivilege	1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

42BE3BED9261FBAE0A0AED767EBD88C0.exe

description	pid	process	target process
PID 1888 wrote to memory of 784	1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe	server.exe
PID 1888 wrote to memory of 784	1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe	server.exe
PID 1888 wrote to memory of 784	1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe	server.exe
PID 1888 wrote to memory of 784	1888	42BE3BED9261FBAE0A0AED767EBD88C0.exe	server.exe

C:\Users\Admin\AppData\Local\Temp\42BE3BED9261FBAE0A0AED767EBD88C0.exe
"C:\Users\Admin\AppData\Local\Temp\42BE3BED9261FBAE0A0AED767EBD88C0.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
2⤵
- Executes dropped EXE
PID:784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\server.exe
Filesize
282KB

MD5
9b0975e52c196e91d4bee83ec4a2d950

SHA1
e049054e78b39dbc0d0b69ae88e03a86bab502a2

SHA256
cd3ad6a8b2816ffcb6e38662071a3304562543e735fc730852316838c3ffefce

SHA512
91d38e6b53dac21ad2dd1010e86957a76d890efe8e9cc4dee55d03055a73a86764bd17b183d8c604d0ab7eae792d0cd6d5e5d74e7037200f9267da20db643751

Download Submit
memory/1888-0-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/1888-1-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/1888-2-0x0000000001E40000-0x0000000001E80000-memory.dmp

Filesize
256KB

Download
memory/1888-7-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/1888-8-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/1888-9-0x0000000001E40000-0x0000000001E80000-memory.dmp

Filesize
256KB

Download