cybergate | 22ae9ebc516aa9d6460ed1f3f1470c4aab16ca4805a5fee3b459b878ad41637e

Analysis

max time kernel
149s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
Size

419KB
MD5

2bd46cadf730df93ca24682e2dc509be
SHA1

94f1fd94424364b7f5770eda24082ec2a30e2e12
SHA256

22ae9ebc516aa9d6460ed1f3f1470c4aab16ca4805a5fee3b459b878ad41637e
SHA512

d25dbe6978ae2c1469f6a058899bfcf06a6594f51a5dd5f6e49707ed6480fa5246c5a01452e2d818e23b993c242d8a768cdfd72ba686b156dd7362d17d2dd2f9
SSDEEP

6144:H6BsG/UrIrM+NW6o2SWnIq+ikCdGodAXbAFIJ23m24HyACZ7XbidbEFo6o:aBsG8r4/xS2hdEbAK23m24SAsDbcEa

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

vítima

koko7878.no-ip.biz:82

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exe2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{AKB5W153-3BUY-IN65-R0OG-SGOFN84X8QC0}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AKB5W153-3BUY-IN65-R0OG-SGOFN84X8QC0}\StubPath = "C:\\Windows\\install\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{AKB5W153-3BUY-IN65-R0OG-SGOFN84X8QC0}	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AKB5W153-3BUY-IN65-R0OG-SGOFN84X8QC0}\StubPath = "C:\\Windows\\install\\server.exe Restart"	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/112-4-0x0000000024010000-0x0000000024052000-memory.dmp	upx
behavioral2/memory/440-60-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/440-61-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/112-56-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/112-65-0x00000000240B0000-0x00000000240F2000-memory.dmp	upx
behavioral2/memory/112-68-0x0000000024100000-0x0000000024142000-memory.dmp	upx
behavioral2/memory/3148-123-0x0000000024100000-0x0000000024142000-memory.dmp	upx
behavioral2/memory/440-144-0x0000000024060000-0x00000000240A2000-memory.dmp	upx
behavioral2/memory/3148-149-0x0000000024100000-0x0000000024142000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

Processes:

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\install\server.exe	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
File opened for modification	C:\Windows\install\server.exe	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exeexplorer.exe2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

pid	Process
112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

pid	Process
3148	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	3148	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
Token: SeDebugPrivilege	3148	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

pid	Process
112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe

description	pid	Process	procid_target
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56
PID 112 wrote to memory of 3504	112	2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3504
- C:\Users\Admin\AppData\Local\Temp\2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - System Location Discovery: System Language Discovery
    PID:440
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2bd46cadf730df93ca24682e2dc509be_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UuU.uUu

Filesize
8B

MD5
888318e7dbb1fb9d5ccbf166f9410b7c

SHA1
ba1767afaf535060ae773c5796035ee2593a3be8

SHA256
25887b9485e305ba89a9d7bf9ed2a63cb43bd65ced74747ffccad195e7cd7707

SHA512
e9f4dcdd95c622b9315a64342435b4144da9acbc5c55983153c936e372e6546b14cedc09f9ac2b76f8302c35c947c2e974ad96d157bd127577b6e300804e202e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
189KB

MD5
3af42aba8b1819f8b808bd12923c1b95

SHA1
ed3f2ef480822a686a0547c7840d3f313e1a21ad

SHA256
9206d8fb74bcf06893cf263b7e6837dfc78a9fb6d2c38e37c23bdacc11d5a5a9

SHA512
4b400d590f70047c40b4ab987f0b4bd46c108d37a7a2e189b6d44505e622a294f7b8907c7b33badba24b39c2df47b5246f73fd53583e9807d39350e330c7e593

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat

Filesize
15B

MD5
4362e21af8686f5ebba224768d292a5b

SHA1
504510a4d10e230dcd1605ab3342525b38a10933

SHA256
b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3

SHA512
f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850

Download Submit
C:\Windows\install\server.exe

Filesize
419KB

MD5
2bd46cadf730df93ca24682e2dc509be

SHA1
94f1fd94424364b7f5770eda24082ec2a30e2e12

SHA256
22ae9ebc516aa9d6460ed1f3f1470c4aab16ca4805a5fee3b459b878ad41637e

SHA512
d25dbe6978ae2c1469f6a058899bfcf06a6594f51a5dd5f6e49707ed6480fa5246c5a01452e2d818e23b993c242d8a768cdfd72ba686b156dd7362d17d2dd2f9

Download Submit
memory/112-126-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/112-65-0x00000000240B0000-0x00000000240F2000-memory.dmp

Filesize
264KB

Download
memory/112-4-0x0000000024010000-0x0000000024052000-memory.dmp

Filesize
264KB

Download
memory/112-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/112-56-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/112-24-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/112-68-0x0000000024100000-0x0000000024142000-memory.dmp

Filesize
264KB

Download
memory/440-59-0x0000000003760000-0x0000000003761000-memory.dmp

Filesize
4KB

Download
memory/440-8-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/440-9-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/440-61-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/440-144-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/440-60-0x0000000024060000-0x00000000240A2000-memory.dmp

Filesize
264KB

Download
memory/3148-123-0x0000000024100000-0x0000000024142000-memory.dmp

Filesize
264KB

Download
memory/3148-145-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3148-149-0x0000000024100000-0x0000000024142000-memory.dmp

Filesize
264KB

Download