cybergate | b7fb68f69d12d113ece53b10fb0dd16eef4cfa17b28330ccfa41888852567d47

Analysis

max time kernel
96s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
Size

736KB
MD5

12bcd77da15f145d39045fc37d5267bf
SHA1

600a83474770c19f6e71128640b6ca490c047f69
SHA256

b7fb68f69d12d113ece53b10fb0dd16eef4cfa17b28330ccfa41888852567d47
SHA512

18b9f46faf81037f8d9f5cf1e7a7f4e80796124f1bf1826422f7ec1ae569f15537b5424a620a89ddde494e2166f10309053777b20cf94661dacfd415ddf6a24b
SSDEEP

12288:lAlcHFXc8ZsGvb22NbeNaOqK2QXjd4g2uDXZ9HrD20CCf34Of:WlkXc8yGi2FeQNQzu7KDRzvf

Score

10^/10

cybergate remote bootkit discovery persistence stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

kirschbom.no-ip.org:100

Mutex

KD7YQN67PUJS72

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Windir
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123456
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 7720	1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	82
PID 7720 set thread context of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5132	3896	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
Token: SeDebugPrivilege	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
Token: SeDebugPrivilege	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 7720	1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	82
PID 1252 wrote to memory of 7720	1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	82
PID 1252 wrote to memory of 7720	1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	82
PID 1252 wrote to memory of 7720	1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	82
PID 1252 wrote to memory of 7720	1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	82
PID 1252 wrote to memory of 7720	1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	82
PID 1252 wrote to memory of 7720	1252	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	82
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83
PID 7720 wrote to memory of 3896	7720	JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_12bcd77da15f145d39045fc37d5267bf.exe
  2⤵
  - Maps connected drives based on registry
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:7720
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\System32\svchost.exe
    3⤵
    PID:3896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 12
      4⤵
      Program crash
      PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3896 -ip 3896
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3896-2801-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/7720-2473-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/7720-2476-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/7720-2477-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/7720-2478-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/7720-2480-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/7720-2802-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download