cybergate | 4dd790d0893d26f7515a0fb72eeab4f6fd7822c48d04b5c2ec794f152deff68a

General

Target

JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe
Size

420KB
MD5

423780663625a99c1f7bebfb50966ed8
SHA1

88c26a36b77e300b1b9a8f90d5f4a367d8f4226d
SHA256

4dd790d0893d26f7515a0fb72eeab4f6fd7822c48d04b5c2ec794f152deff68a
SHA512

7bb34637d0389da9062e0f61791c72d245ec0741554abadb3dc0740e609785997ba9d45f80854f4443bb3992d23f5a016646e8603776214754ad72d1b30b342b
SSDEEP

6144:tiPRxwbOQDXCQ97dRUgwKY+1tJnfE5olnjzWBnJ3MszTt5XLMS6R5F:8PHREXCQR3pY+JfCoF4fJA5F

Score

10^/10

cybergate server discovery stealer trojan

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Server

C2

sven123.no-ip.biz:1338

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Winupd
install_file
svchost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Bild konnte nicht geöffnet werden!
message_box_title
picture opain fail
password
12345
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2428 set thread context of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	2912	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2428 wrote to memory of 2912	2428	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	28
PID 2912 wrote to memory of 2856	2912	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	29
PID 2912 wrote to memory of 2856	2912	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	29
PID 2912 wrote to memory of 2856	2912	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	29
PID 2912 wrote to memory of 2856	2912	JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe	29

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_423780663625a99c1f7bebfb50966ed8.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 44
    3⤵
    - Program crash
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-18-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2428-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2912-17-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-15-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-22-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-20-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-19-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-6-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-23-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-3-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-9-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-21-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing