cybergate | 89d0c43e6a90257dd99ee72fd1a32177847232d30e8ec4cedd900c1b4c6f7252

General

Target
jaffacakes118__29006dfd528a214ac38790ae19068164.exe
Size 620KB
Sample260920-2kd5rsdf23
SHA256 89d0c43e6a90257dd99ee72fd1a32177847232d30e8ec4cedd900c1b4c6f7252
MD5 29006dfd528a214ac38790ae19068164
SHA1 4e8684ce94e579a03fb1977ab60aa6a89bf2dc2d
SHA512 77fe668782377e748bbcfd6c3c63cb824d311ee720a6f873500498394718e7e4dc217672a9846e7c0854831b916adae76d8af5ace80bb426bda4ceaa725e2170
SSDEEP 12288:jw1kgP/eynljtOjPzp2sKBh9aXXFJ/NKfHcmyYBY05A5:sDnltOjPKBhsHFJ/NWa
TLSH
T12DD4F168CEA30958EC9EDC3483ED1C904CB95E56B055DE7DDA3EF51A2ABC0C064B44EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

cyber discovery cybergate persistence stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

cyber

C2

donnadonnadonna.zapto.org:100

Mutex

Update

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
winlogon
install_file
winlogon.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123456
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 3 IoCs

pid	Process
3432	process32.exe
2448	tempfile.exe
4164	process32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\MXPrXSNpLK = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tempfile.exe\""	jaffacakes118__29006dfd528a214ac38790ae19068164.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2364 set thread context of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2448 set thread context of 4164	2448	tempfile.exe	92

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__29006dfd528a214ac38790ae19068164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tempfile.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe
Token: SeDebugPrivilege	2448	tempfile.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2364 wrote to memory of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2364 wrote to memory of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2364 wrote to memory of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2364 wrote to memory of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2364 wrote to memory of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2364 wrote to memory of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2364 wrote to memory of 3432	2364	jaffacakes118__29006dfd528a214ac38790ae19068164.exe	89
PID 2448 wrote to memory of 4164	2448	tempfile.exe	92
PID 2448 wrote to memory of 4164	2448	tempfile.exe	92
PID 2448 wrote to memory of 4164	2448	tempfile.exe	92
PID 2448 wrote to memory of 4164	2448	tempfile.exe	92
PID 2448 wrote to memory of 4164	2448	tempfile.exe	92
PID 2448 wrote to memory of 4164	2448	tempfile.exe	92
PID 2448 wrote to memory of 4164	2448	tempfile.exe	92
PID 2448 wrote to memory of 4164	2448	tempfile.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__29006dfd528a214ac38790ae19068164.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__29006dfd528a214ac38790ae19068164.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\process32.exe
  C:\Users\Admin\AppData\Local\Temp\\process32.exe
  2⤵
  - Executes dropped EXE
  PID:3432

C:\Users\Admin\AppData\Local\Temp\tempfile.exe
"C:\Users\Admin\AppData\Local\Temp\tempfile.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\process32.exe
  C:\Users\Admin\AppData\Local\Temp\\process32.exe
  2⤵
  - Executes dropped EXE
  PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

process32.exe

Path C:\Users\Admin\AppData\Local\Temp\process32.exe
Size 5KB
SHA256 9236208e312b2f47a0ef40e59fc0f364fc8e401717e1e46555c26bec8ab3de1f
MD5 d2ed8fa3208e702b7d61728af768eed1
SHA1 54094aa272cb866a46c2ca5b56f4a094e0f48ffb
SHA512 42442dc0b98f2abaea0c6516602d80df8a2a680278ecdc2b96fe5ce44685f7442347fd4ad13d9d99e0330cf0be7c0e9bbf22bd78c0173066221e430203c76313
SSDEEP 48:yMzNTc1bXQkokdBXUXvAWY7EWKfeJYBcZ/BCKx9DDkVVlERU:p1aAkokdJUXlWEWwOQc5MK3Dw66
TLSH
T127C1344BAB99C8B0C9FD447D6E1B5F54FEA81C80175081BB0BA37AC9E9319C74E2479C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile.exe

Path C:\Users\Admin\AppData\Local\Temp\tempfile.exe
Size 620KB
SHA256 89d0c43e6a90257dd99ee72fd1a32177847232d30e8ec4cedd900c1b4c6f7252
MD5 29006dfd528a214ac38790ae19068164
SHA1 4e8684ce94e579a03fb1977ab60aa6a89bf2dc2d
SHA512 77fe668782377e748bbcfd6c3c63cb824d311ee720a6f873500498394718e7e4dc217672a9846e7c0854831b916adae76d8af5ace80bb426bda4ceaa725e2170
SSDEEP 12288:jw1kgP/eynljtOjPzp2sKBh9aXXFJ/NKfHcmyYBY05A5:sDnltOjPKBhsHFJ/NWa
TLSH
T12DD4F168CEA30958EC9EDC3483ED1C904CB95E56B055DE7DDA3EF51A2ABC0C064B44EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2364-0-0x0000000001A60000-0x0000000001A70000-memory.dmp

Download

memory/2364-1-0x0000000074912000-0x0000000074914000-memory.dmp

Download

memory/2448-12-0x0000000074910000-0x0000000074F31000-memory.dmp

Download

memory/2448-16-0x0000000074910000-0x0000000074F31000-memory.dmp

Download

memory/2448-17-0x0000000074910000-0x0000000074F31000-memory.dmp

Download

memory/3432-5-0x0000000000400000-0x0000000000451000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads