cybergate | 7097c1b6043856989e99f119d42f39ad846f0c0ea3532e1072eb7a3c5a629274

General

Target

JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe
Size

808KB
MD5

a2f8b0ed4ab2da1fb141a4c459fb621e
SHA1

30168bf5b25fae36c0f7d314351f114204dc75ed
SHA256

7097c1b6043856989e99f119d42f39ad846f0c0ea3532e1072eb7a3c5a629274
SHA512

b82560305438d490602d1b55639d28008af42e1604204fb0eec3f37052d60119a3b86ce2e31df706d1eb97165434bd11ce8b0f84fc50991e8f139dfa724b25fb
SSDEEP

12288:eytN/T3n36vreofZ84s1JqEDLNZmdexJzMwtCGXvYFsLJtgxZ9am+qqGSz1eGRj2:eoXom1XRUWWQEgj2NE5

Score

10^/10

cybergate cyber discovery stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

cyber

C2

127.0.0.1:82

glider.no-ip.biz:82

Mutex

21C55QTSN11T42

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
WinLogon
install_file
WinLogon.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
alomhack
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "450933250"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4C49AB94-14F0-11F0-B5E0-CA52A14B7567} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
212	IEXPLORE.EXE
212	IEXPLORE.EXE
212	IEXPLORE.EXE
212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2228	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	86
PID 1708 wrote to memory of 2228	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	86
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 1708 wrote to memory of 2104	1708	JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe	88
PID 2104 wrote to memory of 212	2104	iexplore.exe	90
PID 2104 wrote to memory of 212	2104	iexplore.exe	90
PID 2104 wrote to memory of 212	2104	iexplore.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2f8b0ed4ab2da1fb141a4c459fb621e.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2228
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
16fcbb7e1322c9f6347d87ed2702146f

SHA1
7488269d47a6832f42cdbbdb0d7ed5128133685b

SHA256
a2fa5c27f7227be6f6fb7867142414134d7328cee67744e66f8fa22c8676deda

SHA512
84092ff95eae132c0151bbaddff9264dfb2beab175e25811860a4346cbedb01213251770c97e48271c26b9378f5ab9edabacf4f3cdfa87d7d00b73622da924a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
ce0953e12c27433612d46a7aca61f392

SHA1
7a59f694e0ffd4d7b52579a058791b2086492935

SHA256
64fb41d031b887e703ba0a179720cfb97c1268fc8be4df59a575a1d4a29c9637

SHA512
68c182f580a1a0abecef7f348490579d163d205271506f2be5575f314300fac8f369c81392c8540ec1625aae3792220edec7b8202841daf0e8f0bc3ad23d267f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IBI1KJ4T\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
memory/1708-0-0x0000000074DE2000-0x0000000074DE3000-memory.dmp

Filesize
4KB

Download
memory/1708-1-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/1708-2-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/1708-5-0x0000000074DE0000-0x0000000075391000-memory.dmp

Filesize
5.7MB

Download
memory/2104-3-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing