cybergate | 75cd03c16fcbd48fbe19bdf8564db5d489bd8a641ff175daad8cf6ce6dc15d79

Analysis

max time kernel
148s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Size 404KB
Sample240912-aejphs1brb
SHA256 75cd03c16fcbd48fbe19bdf8564db5d489bd8a641ff175daad8cf6ce6dc15d79
MD5 db7711cedc568fa30baf6cb3a60c87f2
SHA1 3b6d228d4aff57dfde07d9adb158a64340ef8dcc
SHA512 ae24844df98acf836271d3cdd08f9e2cda0421ca736a457460b347360a7f8e954f70b4578478ffa064adee30fd6db657621712e0aa798ae476c26d4d31e0b053
SSDEEP 12288:MNSwRucJEVj8kkvyQFjk4yzczjO9luLZnCA:vwR4t8dBy4zSzuVnH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.2.2

Botnet

vítima

127.0.0.1:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe"	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe"	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\dir\\install\\install\\server.exe Restart"	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3900-13-0x0000000024010000-0x000000002404D000-memory.dmp	upx
behavioral2/memory/3900-17-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/3900-14-0x0000000024010000-0x000000002404D000-memory.dmp	upx
behavioral2/memory/3900-63-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/4376-71-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/4376-80-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/4376-79-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/4376-73-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/4376-69-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/4376-72-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/4376-67-0x0000000024050000-0x000000002408D000-memory.dmp	upx
behavioral2/memory/4376-102-0x0000000024050000-0x000000002408D000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1348 set thread context of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4376	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Token: 33	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Token: SeDebugPrivilege	4376	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
Token: SeDebugPrivilege	4376	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 1348 wrote to memory of 3900	1348	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	93
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94
PID 3900 wrote to memory of 1204	3900	db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Local\Temp\db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\db7711cedc568fa30baf6cb3a60c87f2_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1020,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UuU.uUu

Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
Size 8B
SHA256 382f511173d0a850aebd06b0095257b57017d353f2e6d1624773e04699f91fe0
MD5 eb2b69e632a35dce233dcad47beb0a89
SHA1 c47c30a46eb6fc7805dfc082cb45440e1fe5208f
SHA512 48747c75f8dbabc941142011d07d9c9bbb01aa5ff9e5d32dadc652b8dc12da24ef3ea8d9daaccf66d869c8ec9ca978f7dc7c3320a49d7620e913c107236baa07
MD5 SHA1 SHA512

Submit Download

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 140KB
SHA256 e017ddec79ffeb784a155af8c4e2e7997d40cc779831df28065309f99631d12f
MD5 683f9011016e2e4a7b1eef0cb213d0b5
SHA1 72f0f692c72cb50d9d73807431eefba0f7d80fd1
SHA512 a481148e8103a788ca1666d8d939a090fd8e2aa0fadb290474f553988ca4ac57ae703ef174a321cac7997382502a583a8357e9021890fe001189912b56746b09
SSDEEP 3072:o27eItPPjtq0svSojstQmJlOAWxNrkUG77CuLk6kHi5xygxfBbsi4K:h7eICYo6JoJmmuLXEWxJx5bsi4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb
MD5 86f3c87caff4d7973404ff22c664505b
SHA1 245bc19c345bc8e73645cd35f5af640bc489da19
SHA512 0940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024
MD5 SHA1 SHA512

Submit Download

memory/1348-1-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/1348-2-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/1348-0-0x0000000074C62000-0x0000000074C63000-memory.dmp

Download

memory/1348-12-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/3900-13-0x0000000024010000-0x000000002404D000-memory.dmp

Download

memory/3900-11-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3900-17-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/3900-6-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3900-8-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3900-14-0x0000000024010000-0x000000002404D000-memory.dmp

Download

memory/3900-35-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3900-5-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3900-63-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/3900-68-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4376-66-0x00000000036E0000-0x00000000036E1000-memory.dmp

Download

memory/4376-80-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/4376-79-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/4376-71-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/4376-73-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/4376-18-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4376-69-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/4376-72-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/4376-67-0x0000000024050000-0x000000002408D000-memory.dmp

Download

memory/4376-19-0x0000000000560000-0x0000000000561000-memory.dmp

Download

memory/4376-102-0x0000000024050000-0x000000002408D000-memory.dmp

Download