cybergate | c13d6ff3fbe8f2ef71db5ac0315dc4f580b1695e94c876ad0ca08c7c091bdd09

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c13d6ff3fbe8f2ef71db5ac0315dc4f580b1695e94c876ad0ca08c7c091bdd09.exe
Size 4.6MB
Sample260925-3tctqszy2p
SHA256 c13d6ff3fbe8f2ef71db5ac0315dc4f580b1695e94c876ad0ca08c7c091bdd09
MD5 8085ee49f52b001a6b31ca1db49bdc0f
SHA1 b8fb446e8d94a3c3a2607787375e88600d3a0366
SHA512 a1129d55c81db7644bccb5b12fa5fec65ac8949a8ff2f6f83af31a68771d967397951d0c1e0047aed276764503fe2d21b25fa349379bee7f765e6392ae202171
SSDEEP 98304:NjPCDSV5SLOiOEpyzYEE3o4Hr6h42HTbqFc6hKbcXJJTAPwiqt:1CDSbAOM1MOeG2mXkI1t
TLSH
T15426334A1294C9FBCF9886300492E73A2375BD234B55CD87A59CEE059E33F66437E09B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victime discovery cybergate persistence spyware stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Victime

jerem13.no-ip.biz:1024

Mutex

48JUPY481513M2

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
System32
install_file
sv_chosts.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
administrator
regkey_hkcu
Microsoft_Updater
regkey_hklm
Sv_chosts

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 6 IoCs

pid	Process
5052	MGN4l5rx.exe
1856	RemoveWAT.exe
5528	RemoveWAT_loader.exe
5036	RemoveWAT.EXE
616	Loader.exe
5892	REMOVE~1.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	RemoveWAT.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 616 set thread context of 1596	616	Loader.exe	95

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001000000001c51c-11.dat	upx
behavioral2/memory/1856-12-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/1856-25-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RemoveWAT_loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RemoveWAT_loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MGN4l5rx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MGN4l5rx.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemoveWAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemoveWAT_loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemoveWAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c13d6ff3fbe8f2ef71db5ac0315dc4f580b1695e94c876ad0ca08c7c091bdd09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MGN4l5rx.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5052	MGN4l5rx.exe
5528	RemoveWAT_loader.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5052	4648	jaffacakes118_c13d6ff3fbe8f2ef71db5ac0315dc4f580b1695e94c876ad0ca08c7c091bdd09.exe	89
PID 4648 wrote to memory of 1856	4648	jaffacakes118_c13d6ff3fbe8f2ef71db5ac0315dc4f580b1695e94c876ad0ca08c7c091bdd09.exe	90
PID 1856 wrote to memory of 5528	1856	RemoveWAT.exe	91
PID 5528 wrote to memory of 5036	5528	RemoveWAT_loader.exe	92
PID 5036 wrote to memory of 616	5036	RemoveWAT.EXE	94
PID 616 wrote to memory of 1596	616	Loader.exe	95
PID 616 wrote to memory of 1596	616	Loader.exe	95
PID 616 wrote to memory of 1596	616	Loader.exe	95
PID 616 wrote to memory of 1596	616	Loader.exe	95
PID 616 wrote to memory of 1596	616	Loader.exe	95
PID 616 wrote to memory of 1596	616	Loader.exe	95
PID 616 wrote to memory of 1596	616	Loader.exe	95
PID 616 wrote to memory of 1596	616	Loader.exe	95
PID 5036 wrote to memory of 5892	5036	RemoveWAT.EXE	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c13d6ff3fbe8f2ef71db5ac0315dc4f580b1695e94c876ad0ca08c7c091bdd09.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c13d6ff3fbe8f2ef71db5ac0315dc4f580b1695e94c876ad0ca08c7c091bdd09.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\RemoveWAT\MGN4l5rx.exe
  "C:\Users\Admin\AppData\Local\Temp\RemoveWAT\MGN4l5rx.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5052
- C:\Users\Admin\AppData\Local\Temp\RemoveWAT\RemoveWAT.exe
  "C:\Users\Admin\AppData\Local\Temp\RemoveWAT\RemoveWAT.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\MonProduit\RemoveWAT_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\MonProduit\RemoveWAT_loader.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\MonProduit\RemoveWAT.EXE
      RemoveWAT.EXE
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Loader.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Loader.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:616
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        6⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REMOVE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REMOVE~1.EXE
        5⤵
        Executes dropped EXE
        
        PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Loader.exe
Size 1.0MB
SHA256 98441cb84934192a61a1691112d9009e7bd6cd8d5b44500aef677da925e4a72a
MD5 b54c91be48dcd6d248df80ad88d9f264
SHA1 c47630f387b4f8d9c79f734bb2b887822734125f
SHA512 34f2d4faf73da620cfb9f2e1cf7e6a41049ca44f1ea5779d9093a733bcbc953dbb937d1d03bd95634f197d2db9adeb4871bdf14ff8c403f04459c5af4f95b68a
SSDEEP 12288:6ujxX7OlExpGNgn13yuQWlhp29V1coWep9USCeC5Rj5TPsyQeoGnn/HtNqQjwnCs:6DMKCNnzrVsI3mtC2Ps0TfcAgw7Nzz
TLSH
T17E357D243AEA901AF173EFB58BE4B5EADA2FF7733B07545A1051038B4623A41EDC1539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REMOVE~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REMOVE~1.EXE
Size 6.4MB
SHA256 94a1a26f61b015c2ced2fd50bdba4070b6c9aec7d2938fbf7eb9e99960d3b7a9
MD5 bfacf78644ca41fd6d4b23976e7574a1
SHA1 6bdc28b673d25481a7a5828aca6efd87d2c90b14
SHA512 af53e3314aeeee95a082d7326abb0743f76f19b57f5d604a613858c0014d3454a6b842c844dc6675f61e55f72daff67e2b17127f745ea74a865d8abc97265a2d
SSDEEP 98304:G33yKMaL/eXV1i/kDxkmcL/eXV1i/kaRWYL/eXV1i/kmeM1qj4iwiANvSo2/CAyq:QyKnZrrLGA3PhsKPkG0tWu
TLSH
T1C3669D11BEC1C0A1C05671F0C956A7F696657C20CAE46647B7BCFE2A7B31283DE16E0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveWAT.EXE

Path C:\Users\Admin\AppData\Local\Temp\MonProduit\RemoveWAT.EXE
Size 4.4MB
SHA256 38f8f8a5171523c0b9f87d57004761037110a5e802577e8b728eeaf8b635c95f
MD5 8ea465a9ced8302d35fa30ab68f45a10
SHA1 5178d4f0c2c42087c7c846b0047d0ddeeb5f4e20
SHA512 1e49c969fd3398261c768d93fdadee3ce4404e38cca4872cc9b7c47bc231e253b8176b6222092bc0d6a01f8a67e942f834c29ba37903e057c98aa6befb858959
SSDEEP 98304:bJ3evz64a3gCiZvd16c4HYWNxc7o2hXFwb6+zaboP5LUgbwqgU:bJ3e77awTOeQ8ymUPX0BU
TLSH
T1BC26330212984A9BDDB873F049FA605703767CB25FBAC64A94B978444E73A93DD7C20F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveWAT_loader.exe

Path C:\Users\Admin\AppData\Local\Temp\MonProduit\RemoveWAT_loader.exe
Size 80KB
SHA256 84ebda9da2ac0fdbb08b73d618b250892c4d79b447f25856f16aa8e7829a2f23
MD5 7f24037779a624df79bb8cca8e8100bb
SHA1 08d003f4571b0dc81b532154f5e2a8b141082014
SHA512 21c9196fb4d73c2a37cadac525b65a3b4dfa0fe0d97329c9c3ccffabacf0470df63320dc0b21ce8381a8630fbce463dad60847344bb7a36b95569e1739e28525
SSDEEP 768:8AW3Q8O4f84U3qLvPn+uHBGFITYpQ+kKeCCekgmn6+z54xPn+uHqLmU3vO4f8+Q:XWg8kt6HBG5SOCekgq6I54RH+vkv
TLSH
T13E835E12A5E78514ED3837FD2D1585A9595E3E314930A90FB77BBB7E2933183ECA020E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MGN4l5rx.exe

Path C:\Users\Admin\AppData\Local\Temp\RemoveWAT\MGN4l5rx.exe
Size 80KB
SHA256 b4d076194b2750f7e306f6430efda99aa216d9114934197eef1b5be39a81a5cc
MD5 2f1b15ab912ba22daa8344dccfbf8302
SHA1 c9b424429911e36e87eec0a73381f2744403a5cc
SHA512 f127dfa45d0b3d770467f81c87d69bee8e29e87bbbdbfb1126028f70ba1b30b38c031fa73fdc064444fe385ba5a385a3d0abde329401cc053a5028dc78a30c14
SSDEEP 768:svdhVZLOYs0qN9wbvLPxsqYYQ7bmpEDwm/4/W2tbekGKIz9i+:svdhHLHTpbD5/Q7Sps/0dekfql
TLSH
T18B83A419E9070016F24448758653C6F55DBE3D3339A2A82FFBCA3A1E7CF128624E497B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveWAT.exe

Path C:\Users\Admin\AppData\Local\Temp\RemoveWAT\RemoveWAT.exe
Size 4.4MB
SHA256 b79bb02a267986c3e7e70f1f05b2cc2d8f24004fef223574a7a08bcde6554bb5
MD5 d878c41440342583547fdcc417700ed7
SHA1 60d552a9bbc25c29f9e1cab439e187f2fbcfbe02
SHA512 295cbe411220a8eb3aa59eb0d8c31296d2c8fcf85521e9d8e1352787a1df136e31ee1d04c6b51376b830917756dd647c061f2b4ce5b7cb706978f5e5242f1e07
SSDEEP 98304:P7VAzEXJID+qoU1sVEQ45AmBtMVU2LP3stqy7Yboff59sPwysOT:hAzEZY+U1MkycYqfEIROT
TLSH
T17126331202789ECBCFACC7314B52E5AD03B52C729F99C94964CE79085AB3F2752BD05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-41-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1856-15-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/1856-25-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/1856-12-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/5892-48-0x000000001BFA0000-0x000000001C046000-memory.dmp

Download

memory/5892-49-0x000000001C5E0000-0x000000001CAAE000-memory.dmp

Download

memory/5892-50-0x000000001CB50000-0x000000001CBEC000-memory.dmp

Download

memory/5892-51-0x00000000019C0000-0x00000000019C8000-memory.dmp

Download

memory/5892-52-0x000000001CC70000-0x000000001CCBC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads