cybergate | 17c0b21baef7a9c18a9f43b507194cbb2cd3cc0379ca8b5ee5f9c65758435924

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2025, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe
Size

472KB
MD5

87c7a661c1ac80aec7e626c255736e2c
SHA1

7b8dff98a5583dfd43cfabfc7204f051b6eccaff
SHA256

17c0b21baef7a9c18a9f43b507194cbb2cd3cc0379ca8b5ee5f9c65758435924
SHA512

c360c8f730edc161cd1c68dff232785439d4b14f005586b0f84726a4a78a9da05d250e74827d47b81d147d09076d908c56b0f9ecfc0b890a6a8f2c66ce1ded04
SSDEEP

6144:iEYZe3O5JGmrpQsK3RD2u270jupCJsCxCL+YjUyf0YzRspfFHgjtx+NJmAcAGVfn:ke3XZ2zkPaCx1YQyMhHHLNAFAGmG

Score

10^/10

cybergate öííé discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

djazayer14.no-ip.org:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_file
windows.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
t?tulo da mensagem
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\windows.exe"	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\windows.exe"	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "C:\\Program Files (x86)\\windows.exe Restart"	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1964-14-0x0000000024010000-0x0000000024072000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\windows.exe	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe
File created	C:\Program Files (x86)\windows.exe	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2268	1964	WerFault.exe	81
1220	1964	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe
1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56
PID 1964 wrote to memory of 3500	1964	JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_87c7a661c1ac80aec7e626c255736e2c.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 600
    3⤵
    - Program crash
    PID:2268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 616
    3⤵
    - Program crash
    PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1964 -ip 1964
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1964 -ip 1964
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-1-0x0000000002230000-0x000000000227E000-memory.dmp

Filesize
312KB

Download
memory/1964-0-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1964-6-0x0000000076540000-0x0000000076541000-memory.dmp

Filesize
4KB

Download
memory/1964-5-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/1964-4-0x0000000077482000-0x0000000077483000-memory.dmp

Filesize
4KB

Download
memory/1964-3-0x0000000002470000-0x0000000002480000-memory.dmp

Filesize
64KB

Download
memory/1964-2-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/1964-7-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1964-8-0x0000000076520000-0x0000000076610000-memory.dmp

Filesize
960KB

Download
memory/1964-9-0x0000000076520000-0x0000000076610000-memory.dmp

Filesize
960KB

Download
memory/1964-11-0x0000000076520000-0x0000000076610000-memory.dmp

Filesize
960KB

Download
memory/1964-10-0x0000000076520000-0x0000000076610000-memory.dmp

Filesize
960KB

Download
memory/1964-14-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1964-18-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1964-19-0x0000000002230000-0x000000000227E000-memory.dmp

Filesize
312KB

Download
memory/1964-20-0x0000000076520000-0x0000000076610000-memory.dmp

Filesize
960KB

Download