cybergate | cf4e3a0e2842ec4eef3cf250b53a6198dc5a4095fc240244eb159c1b505e2803

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Size

1.1MB
MD5

830e7976d36159b838cadeeadb857ba3
SHA1

eeccf3b2c00c879b6d62ab2e48f8ab2d756f8455
SHA256

cf4e3a0e2842ec4eef3cf250b53a6198dc5a4095fc240244eb159c1b505e2803
SHA512

26a7945dc3fac30a492095fa913074c82dec731db340aa2f130dd22ca38f9fe145263aec0b036adb824f79cc28bf459ce86a29f5714fb68b292e135bb423e7c5
SSDEEP

24576:OxiD/9Wm355VPj227l3kQGOSiRB/KsFRu0MH+ZsNHT:O6512y8OjjKQRDMHXNHT

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

127.0.0.1:81

porta3232.no-ip.biz:81

zdox.no-ip.biz:81

Mutex

***p4r4d0xFUCKEU***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
darkc0de
install_file
SPY_NET_RAT.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
SPY_NET_RAT
regkey_hklm
SPY_NET_RAT

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe"	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe"	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1G2A23V1-2607-FHV7-VV67-V1J75CSKG724}	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1G2A23V1-2607-FHV7-VV67-V1J75CSKG724}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe Restart"	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPY_NET_RAT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe"	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SPY_NET_RAT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe"	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1848 set thread context of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 set thread context of 1116	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	85

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3396-2-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3396-4-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3396-5-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3396-6-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3396-18-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/3396-22-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3396-97-0x0000000000400000-0x0000000000459000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exeexplorer.exe830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

pid	Process
3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

pid	Process
3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

pid	Process
1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1848 wrote to memory of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 wrote to memory of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 wrote to memory of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 wrote to memory of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 wrote to memory of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 wrote to memory of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 wrote to memory of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 wrote to memory of 3396	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	84
PID 1848 wrote to memory of 1116	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	85
PID 1848 wrote to memory of 1116	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	85
PID 1848 wrote to memory of 1116	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	85
PID 1848 wrote to memory of 1116	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	85
PID 1848 wrote to memory of 1116	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	85
PID 1848 wrote to memory of 1116	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	85
PID 1848 wrote to memory of 1116	1848	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	85
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56
PID 3396 wrote to memory of 3580	3396	830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3580
- C:\Users\Admin\AppData\Local\Temp\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe"
  2⤵
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1428
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2732
- - C:\Users\Admin\AppData\Local\Temp\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\830e7976d36159b838cadeeadb857ba3_JaffaCakes118.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
240KB

MD5
b035915530d8b4dcc191e2cbb3881646

SHA1
16cc5eeb9d598c51a293a6d784d00fc12ef18271

SHA256
e642e34c3df7ca9de63bdd1f6e4df2cb180c54f4366d7b0076cec6c2d63e2fc3

SHA512
56b81676668db68b3de7b03a3eda728800d1a251d63c70ee592d7900c831ac2d1d6915efd2dc5536e7b6db022d1cd845d991ead6c047c35f6988358328e51fb3

Download Submit
memory/1116-8-0x00000000005BD000-0x0000000000644000-memory.dmp

Filesize
540KB

Download
memory/1116-16-0x0000000000400000-0x00000000006438E1-memory.dmp

Filesize
2.3MB

Download
memory/1116-9-0x00000000005BD000-0x0000000000644000-memory.dmp

Filesize
540KB

Download
memory/1116-10-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1116-12-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1116-14-0x0000000000400000-0x00000000006438E1-memory.dmp

Filesize
2.3MB

Download
memory/1116-7-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1116-11-0x0000000000400000-0x00000000006438E1-memory.dmp

Filesize
2.3MB

Download
memory/1428-24-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/1428-23-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1428-43-0x0000000000040000-0x0000000000473000-memory.dmp

Filesize
4.2MB

Download
memory/1848-15-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3396-97-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3396-6-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3396-18-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/3396-5-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3396-22-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3396-4-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3396-2-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download