Overview
overview
10Static
static
10CyberGate ...al.exe
windows7-x64
5CyberGate ...al.exe
windows10-2004-x64
3CyberGate ...er.exe
windows7-x64
10CyberGate ...er.exe
windows10-2004-x64
10CyberGate ....5.exe
windows7-x64
3CyberGate ....5.exe
windows10-2004-x64
3CyberGate ...er.exe
windows7-x64
10CyberGate ...er.exe
windows10-2004-x64
10CyberGate ...e3.dll
windows7-x64
5CyberGate ...e3.dll
windows10-2004-x64
5Dark Comet...ty.exe
windows7-x64
3Dark Comet...ty.exe
windows10-2004-x64
3Dark Comet...et.exe
windows7-x64
10Dark Comet...et.exe
windows10-2004-x64
10Dark Comet...er.exe
windows7-x64
3Dark Comet...er.exe
windows10-2004-x64
3Dark Comet...er.exe
windows7-x64
10Dark Comet...er.exe
windows10-2004-x64
10Dark Comet...e3.dll
windows7-x64
3Dark Comet...e3.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 16:42
Behavioral task
behavioral1
Sample
CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel_v2.5.5.1-trial.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel_v2.5.5.1-trial.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/server.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
CyberGate Excel v2.5.5.1 - Trial/CyberGate Excel v2.5.5.1 - Trial/server.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
CyberGate v1.07.5/CyberGate v1.07.5/CyberGate v1.07.5.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
CyberGate v1.07.5/CyberGate v1.07.5/CyberGate v1.07.5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
CyberGate v1.07.5/CyberGate v1.07.5/server.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
CyberGate v1.07.5/CyberGate v1.07.5/server.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
CyberGate v1.07.5/CyberGate v1.07.5/sqlite3.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
CyberGate v1.07.5/CyberGate v1.07.5/sqlite3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Dark Comet 5.3/Dark Comet/Celesty Binder/Celesty.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Dark Comet 5.3/Dark Comet/Celesty Binder/Celesty.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Dark Comet 5.3/Dark Comet/DarkComet.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Dark Comet 5.3/Dark Comet/DarkComet.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Dark Comet 5.3/Dark Comet/Spoof extensions/Spoofer.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Dark Comet 5.3/Dark Comet/Spoof extensions/Spoofer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Dark Comet 5.3/Dark Comet/server.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
Dark Comet 5.3/Dark Comet/server.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Dark Comet 5.3/Dark Comet/sqlite3.dll
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
Dark Comet 5.3/Dark Comet/sqlite3.dll
Resource
win10v2004-20241007-en
General
-
Target
CyberGate v1.07.5/CyberGate v1.07.5/CyberGate v1.07.5.exe
-
Size
2.3MB
-
MD5
fc6ee683f28c4d867b069841b45cde8b
-
SHA1
7ba5b8f07bd86a85b583f8c92d27bb94792b6373
-
SHA256
d2119d9dce199cab558514bb1de19a59b207a9d654d0ed1477fa2d98f20e3dc3
-
SHA512
a74f81bb2fa4806abb61e7c8b66fe60b2827120a5558ced95076d3af37e517a4395f28750875fb7cca197258502d8eee3221ee6c4a9fd76e5ec95c4ec5563f56
-
SSDEEP
49152:jBcY9bLMtRGHMTy+hjt2cTl4XRsme9qwwoHXi3Ic+8R1Hg3wx:iftRmsy+l4cIe9qn2XsIcHrx
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CyberGate v1.07.5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2796 CyberGate v1.07.5.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe 2796 CyberGate v1.07.5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CyberGate v1.07.5\CyberGate v1.07.5\CyberGate v1.07.5.exe"C:\Users\Admin\AppData\Local\Temp\CyberGate v1.07.5\CyberGate v1.07.5\CyberGate v1.07.5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5c31f9719e10071c3591a5ab99f8bb6c3
SHA1123b4045ed0a4094cc5ea7f5456ee48fa567e7cd
SHA256c2349fec416c3d0fcd12050b647d000a9049619002219ff45d2d1855a7739afd
SHA512103839c5dcb2e25d4e6f7ce24f5a800988de58fb156b946c6bb794b510a2a102dda67cba826ffadca7ee52af13daf8e0e94ecfec1fd2f2d04c6557653234784c