cybergate | e711beb5e2b76afc898b58d49a18a2b7ab6bc115da35082da0413a549e04c3c6

General

Target
jaffacakes118_HDClone Professional Edition v.4.0.5.Retail_setup.exe
Size 13.4MB
Sample260910-d26pcawcjc
SHA256 e711beb5e2b76afc898b58d49a18a2b7ab6bc115da35082da0413a549e04c3c6
MD5 730e1a0e589f9d3abbecc01819d3c330
SHA1 94541b767fac038a3fdf49c6810efcb73e8fd57c
SHA512 9a5c980a1ee657f024b7fde628143b7f60759888f78e6cc5c22cd66bfe8572a0f1a6523a9b6f0a4568fc2ec26bce1165a4693e318da5b66880301806a18b888d
SSDEEP 393216:NvENvirCPaRM4M0onqAERNYMYz4iC6BnKioeM:NvivirCPatM0onFGNYDz4iC65N
TLSH
T12EE623ABE1EC0DD9D0A0A6F2D337E03116A32C4CACB4C9AFB0C5BF9B75725885667151
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remote discovery cybergate installer persistence stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.13.1

Botnet

remote

C2

neelix.no-ip.biz:4321

Mutex

VMPYDN8IX6665P

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
neelix1337
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 3 IoCs

pid	Process
5892	mmm.exe
2476	mmm.exe
3336	setup.exe

Loads dropped DLL 7 IoCs

pid	Process
3336	setup.exe
3336	setup.exe
3336	setup.exe
3336	setup.exe
3336	setup.exe
3336	setup.exe
3336	setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_HDClone Professional Edition v.4.0.5.Retail_setup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5892 set thread context of 2476	5892	mmm.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HDClone Professional Edition v.4.0.5.Retail_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c557-15.dat	nsis_installer_1
behavioral2/files/0x000d00000001c557-15.dat	nsis_installer_2

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5892	mmm.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 5892	2136	jaffacakes118_HDClone Professional Edition v.4.0.5.Retail_setup.exe	89
PID 5892 wrote to memory of 2476	5892	mmm.exe	90
PID 5892 wrote to memory of 2476	5892	mmm.exe	90
PID 5892 wrote to memory of 2476	5892	mmm.exe	90
PID 5892 wrote to memory of 2476	5892	mmm.exe	90
PID 5892 wrote to memory of 2476	5892	mmm.exe	90
PID 5892 wrote to memory of 2476	5892	mmm.exe	90
PID 5892 wrote to memory of 2476	5892	mmm.exe	90
PID 5892 wrote to memory of 2476	5892	mmm.exe	90
PID 2136 wrote to memory of 3336	2136	jaffacakes118_HDClone Professional Edition v.4.0.5.Retail_setup.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HDClone Professional Edition v.4.0.5.Retail_setup.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HDClone Professional Edition v.4.0.5.Retail_setup.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mmm.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mmm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mmm.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mmm.exe
    3⤵
    - Executes dropped EXE
    PID:2476
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mmm.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mmm.exe
Size 368KB
SHA256 33e0e8c8568203ac273a8e94af4d98fd3b0908f3e723e73bc2fe678a82b261b5
MD5 da0beb778f5aedf90c105858671d7f24
SHA1 d1b55d2b665964d57a2724b645c14e7553c49bc0
SHA512 a348f5aa24ba56014e544fefe68983b32b72e914984de25176b88970daeb2a74e891b1bb1db68ed7ec833dcebf85951c06924c138069166611f51a1e14b322dc
SSDEEP 6144:pbJR8XNOZG1Keb8aClzEQLGuVPq6SQaU299fubZlxkPugPSFO4fHqlykXwK:pbJoNOZG1j8aCa0Pq6QUOfupkGgYO6HG
TLSH
T1BD84E02AAD166107F58289B01AA540F26F3DBC373945691BF740AF8C2A716C3B4F572F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
Size 13.0MB
SHA256 428821ad139324be647ba0f6ac748ad6037b78e9d95a739919a995fbd2897a3b
MD5 c601ca8025aa08743c43726179f1f52e
SHA1 5853dccac81a690e0efa9e4f62602151f94359c1
SHA512 8594e57133ac587e0f1addd2c84def942e94ee6d2944aeaee6d8f43be35ae3a97263ead3d0c5e747d5ae454d50d7bb4ac0f0dc8a615744eccbb6227889f9729d
SSDEEP 393216:hvsZyHyyYT+O82u9WaFBAqgY626czSuyk6Ma:hvsZyHyyzO82uYGBAvY626cufz
TLSH
T1F2D623ABE0EC0DD9D0A0A5F2C337E03566A32D0CACB5C8AFB0C5BF9B75725885667451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaC1C1.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaC1C1.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
TLSH
T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaC1C1.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2476-10-0x0000000000400000-0x000000000044D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads