cybergate | 7ffa743e4091ee4dbcc8232b89e5a60350f99c391dc2effb9a2082eb3ecda66d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 19:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
Size 943KB
Sample240619-x63yssserp
SHA256 7ffa743e4091ee4dbcc8232b89e5a60350f99c391dc2effb9a2082eb3ecda66d
MD5 00250311304ad33d540e7a77e434d861
SHA1 8bf361b1764c2ede5d723d284e4c868369fbe5f6
SHA512 868f276b9a2ac38be81dd3404a187e0d29115b3ab9de8b9483ec3aedd67ea8a9dba7142043a3e5c641cfbb4a743efa5c8773d84ea0d0a9c443c8ff84d58a9169
SSDEEP 24576:9RmJkcoQricOIQxiZY1iaHetnMyNVUBifm2foW:yJZoQrbTFZY1iaH4nHmk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

spy7100.no-ip.info:3460

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
system32
install_file
explorer..exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
sistemawindows
regkey_hklm
sistemawindows

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\system32 = "C:\\Windows\\system32\\explorer..exe"	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\system32 = "C:\\Windows\\system32\\explorer..exe"	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{I3XL52YB-5AK7-1RD6-KU7N-D75B57WAT5RH}\StubPath = "C:\\Windows\\system32\\explorer..exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{I3XL52YB-5AK7-1RD6-KU7N-D75B57WAT5RH}	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{I3XL52YB-5AK7-1RD6-KU7N-D75B57WAT5RH}\StubPath = "C:\\Windows\\system32\\explorer..exe Restart"	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{I3XL52YB-5AK7-1RD6-KU7N-D75B57WAT5RH}	explorer.exe

Deletes itself 1 IoCs

pid	Process
1796	explorer.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3104-0-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3104-2-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3104-3-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3104-4-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3104-8-0x0000000024010000-0x0000000024052000-memory.dmp	upx
behavioral2/memory/3104-11-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/3104-59-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/544-63-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/544-66-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/3104-67-0x00000000240B0000-0x00000000240F2000-memory.dmp	upx
behavioral2/memory/3104-122-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/1796-125-0x00000000240B0000-0x00000000240F2000-memory.dmp	upx
behavioral2/memory/1796-166-0x00000000240B0000-0x00000000240F2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sistemawindows = "C:\\Windows\\system32\\explorer..exe"	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sistemawindows = "C:\\Windows\\system32\\explorer..exe"	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00050000000006cf-65.dat	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\explorer..exe	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\explorer..exe	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\explorer..exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 3104	948	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1796	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	explorer.exe
Token: SeDebugPrivilege	1796	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 3104	948	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	82
PID 948 wrote to memory of 3104	948	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	82
PID 948 wrote to memory of 3104	948	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	82
PID 948 wrote to memory of 3104	948	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	82
PID 948 wrote to memory of 3104	948	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	82
PID 948 wrote to memory of 3104	948	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	82
PID 948 wrote to memory of 3104	948	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	82
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56
PID 3104 wrote to memory of 3384	3104	00250311304ad33d540e7a77e434d861_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\00250311304ad33d540e7a77e434d861_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Users\Admin\AppData\Local\Temp\00250311304ad33d540e7a77e434d861_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\00250311304ad33d540e7a77e434d861_JaffaCakes118.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      PID:544
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Deletes itself
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UuU.uUu

Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
Size 8B
SHA256 e8361817d3a179b11f7f2bd18762ad2cecb35f0997d6627c3d0a0fde812c1fea
MD5 7961aa44b77e4af4dc41a54a9dd52330
SHA1 54cf8c8da28e5fc35793e579130451316636edc4
SHA512 aa943e100c6aba2a82198d348193f7dea0e29549dca4fc0381b38a65da3f2faf45f0d592e108d43e4f04eaeb810b940fca1c386d1a5cfe4f39f23dff5df19b65
MD5 SHA1 SHA512

Submit Download

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 189KB
SHA256 e3ef93117ee7c303dbdf2ffb65ba9e4804a4407370aa3720516bd3078767223c
MD5 36a4b8b6d4397ddd2e5e69bb4c85d335
SHA1 1558a5ba1df42f06f796576388c655c88c5d774a
SHA512 44c6b5bd915dd4bfc963de681a0b4914cb919f29bb36f0c9e1abc9986f53410184f8684e2cfef3b38a9600f9c035682a761b8988d6913c887dfc458580db2a5c
SSDEEP 3072:ohOY3xYe0afUDhFnJHqCRNuieR6AdkftzhgWQcaMIqcViTyKayGqyA0i8XZodAFf:OrIrM+NW6o2SWnIq+ikCdGodAXbAE
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3
MD5 4362e21af8686f5ebba224768d292a5b
SHA1 504510a4d10e230dcd1605ab3342525b38a10933
SHA512 f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850
MD5 SHA1 SHA512

Submit Download

explorer..exe

Path C:\Windows\SysWOW64\explorer..exe
Size 943KB
SHA256 7ffa743e4091ee4dbcc8232b89e5a60350f99c391dc2effb9a2082eb3ecda66d
MD5 00250311304ad33d540e7a77e434d861
SHA1 8bf361b1764c2ede5d723d284e4c868369fbe5f6
SHA512 868f276b9a2ac38be81dd3404a187e0d29115b3ab9de8b9483ec3aedd67ea8a9dba7142043a3e5c641cfbb4a743efa5c8773d84ea0d0a9c443c8ff84d58a9169
SSDEEP 24576:9RmJkcoQricOIQxiZY1iaHetnMyNVUBifm2foW:yJZoQrbTFZY1iaH4nHmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-63-0x0000000024060000-0x00000000240A2000-memory.dmp

Download

memory/544-13-0x0000000001330000-0x0000000001331000-memory.dmp

Download

memory/544-12-0x0000000001270000-0x0000000001271000-memory.dmp

Download

memory/544-62-0x0000000003B30000-0x0000000003B31000-memory.dmp

Download

memory/544-66-0x0000000024060000-0x00000000240A2000-memory.dmp

Download

memory/1796-166-0x00000000240B0000-0x00000000240F2000-memory.dmp

Download

memory/1796-125-0x00000000240B0000-0x00000000240F2000-memory.dmp

Download

memory/3104-8-0x0000000024010000-0x0000000024052000-memory.dmp

Download

memory/3104-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3104-4-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3104-67-0x00000000240B0000-0x00000000240F2000-memory.dmp

Download

memory/3104-122-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3104-3-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3104-59-0x0000000024060000-0x00000000240A2000-memory.dmp

Download

memory/3104-2-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3104-11-0x0000000024060000-0x00000000240A2000-memory.dmp

Download