cybergate | 7387389b94d473d7af3d2ac130f024c268723f534f33122d1a32f7063c7f0e2f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe
Size 1.1MB
Sample240717-d4vd4atgml
SHA256 7387389b94d473d7af3d2ac130f024c268723f534f33122d1a32f7063c7f0e2f
MD5 514ea6821a66125f8f0f55dbcc6c10cc
SHA1 f1a61823035af46ef199e6eadedd80ca141c2753
SHA512 d5ce83c89cd8682c360fa15ae33d02c7e492d3213a7cb570058b2b9ed41da2725f0ddb7e640c08d88157b326cfe8a3496417de12d8d902a7510eaeaa5e2ba635
SSDEEP 24576:lPGSY91VwNJcFMqTwo4zMyMPy+mfeK15bSGm5ty+Oo3:tGJyVjo4zKWfecFST5tqo3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

marwan19.no-ip.biz:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 2 IoCs

pid	Process
2244	7za.exe
3148	Server.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234b1-11.dat	upx
behavioral2/memory/3148-13-0x0000000000400000-0x0000000000457200-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3628	3148	WerFault.exe	91

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1800	760	514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe	87
PID 760 wrote to memory of 1800	760	514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe	87
PID 760 wrote to memory of 1800	760	514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe	87
PID 1800 wrote to memory of 2244	1800	cmd.exe	89
PID 1800 wrote to memory of 2244	1800	cmd.exe	89
PID 1800 wrote to memory of 2244	1800	cmd.exe	89
PID 760 wrote to memory of 3148	760	514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe	91
PID 760 wrote to memory of 3148	760	514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe	91
PID 760 wrote to memory of 3148	760	514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\514ea6821a66125f8f0f55dbcc6c10cc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\7za.exe" "x" "-y" "C:\Users\Admin\AppData\Roaming\Server.7z" "-pSaltyDave""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Roaming\7za.exe
    "C:\Users\Admin\AppData\Roaming\7za.exe" "x" "-y" "C:\Users\Admin\AppData\Roaming\Server.7z" "-pSaltyDave"
    3⤵
    - Executes dropped EXE
    PID:2244
- C:\Users\Admin\AppData\Roaming\Server.exe
  C:\Users\Admin\AppData\Roaming\Server.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 228
    3⤵
    - Program crash
    PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3148 -ip 3148
1⤵
PID:3200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 348KB
SHA256 914b9acf079fa67d5b67f24ba7d2197906848e834b491b4a804666f70d289ecb
MD5 778eed51e8a5dcddbc71f69cae4cb0aa
SHA1 97bacd79b0fa686c3d881b9972155f27c28fafd2
SHA512 24a4cebba891126f9b61b9426e226f8f4807d4388f3f995b5afd1441ec271ef91eefeee23a2b3ec89d7320d943d2df30e1d6b3af5f29cab68e29c465bfd3b6f9
SSDEEP 6144:lAk4qmYJwW1aFDvX68Krq96yd6ZHyq13jglrzXn0iB:x97AFjXkxsmdzyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Roaming\7za.exe
Size 574KB
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.7z

Path C:\Users\Admin\AppData\Roaming\Server.7z
Size 265KB
SHA256 44102518613d2ff4135c932096928f581d8e6d8b755a46e3a5c4140f05ed74a9
MD5 4eab873eb1e16c20c791272aa7cb7f1c
SHA1 d9273f00019293b2db07ae5376dceb5717261b6b
SHA512 943219cc1236806092ab57923b7e07882502cc451f4346b9d0cbc1a06c9cc15ed766ce181e26f0313ec39a0907dd3e993b2e9f8de3796e703923cc7307f600d6
SSDEEP 6144:GbxuKJeCkHOm4TWJSq9bfTs7ZY89jJCmNRFfULoj:GbxuKsjuWJP9bbstjJCmNRFMLoj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3148-13-0x0000000000400000-0x0000000000457200-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads