Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2023 00:07
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1.exe
-
Size
872KB
-
MD5
c56b5f0201a3b3de53e561fe76912bfd
-
SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417
-
SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
-
SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
SSDEEP
12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Malware Config
Extracted
Family
darkgate
C2
http://107.181.161.20
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 17 IoCs
description pid Process procid_target PID 3692 created 2388 3692 1.exe 34 PID 3692 created 3560 3692 1.exe 48 PID 3692 created 3844 3692 1.exe 51 PID 3692 created 2388 3692 1.exe 34 PID 3692 created 3560 3692 1.exe 48 PID 3692 created 3932 3692 1.exe 73 PID 3692 created 3932 3692 1.exe 73 PID 3692 created 3932 3692 1.exe 73 PID 3692 created 2400 3692 1.exe 75 PID 3692 created 2400 3692 1.exe 75 PID 3692 created 3560 3692 1.exe 48 PID 3692 created 2388 3692 1.exe 34 PID 3692 created 2072 3692 1.exe 60 PID 3692 created 3932 3692 1.exe 73 PID 3692 created 3560 3692 1.exe 48 PID 408 created 3932 408 cmd.exe 73 PID 408 created 1388 408 cmd.exe 86 -
Blocklisted process makes network request 10 IoCs
flow pid Process 16 408 cmd.exe 17 408 cmd.exe 18 408 cmd.exe 37 408 cmd.exe 38 408 cmd.exe 42 408 cmd.exe 48 408 cmd.exe 49 408 cmd.exe 50 408 cmd.exe 56 408 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agcfchd.lnk cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3692 set thread context of 408 3692 1.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings 1.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 3692 1.exe 408 cmd.exe 408 cmd.exe 408 cmd.exe 408 cmd.exe 408 cmd.exe 408 cmd.exe 1640 AcroTextExtractor.exe 1640 AcroTextExtractor.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 408 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86 PID 3692 wrote to memory of 1388 3692 1.exe 86
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2388
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3560
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"2⤵PID:1388
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3844
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2072
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\1.exeC:\Users\Admin\AppData\Local\Temp\1.exe 2.au31⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:4972
-
-
C:\Windows\SysWOW64\cmd.execmd.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:408
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134B
MD58112ef05442eca8d725d21e3f7640a15
SHA1ed975006ee00c53929f0ab46b4ea1f46ffdbafa9
SHA25674f33ab0369c479af8e8cfdbf52c377b6fd4458315f9fcd10d701443917e6f6b
SHA512946a6be9945e0bb1bba324722d95b9bab3d73fd6329b213a60252bd0d256db91cb37f1914e270827ea3420272ac1cba3be693938c2e8e8837a87bda5f0ee5d8b
-
Filesize
134B
MD5594ea12a177bc5eb799934e0a1d1de31
SHA12ba42fb0d921b8dab85685833b4ef89305aedaea
SHA256aa035c0e143cf830653e5ef673751a07dc757d4fc899f8844eec595faf9c8523
SHA512923a9a1d23f839d7a42eba7d9b61d1defc503e94f9ca953fc281b07751d40909a02b39b65ad5ced48b3ae55dfec42838a8907367f2a7793aeddce053b0623a0f
-
Filesize
777KB
MD50e3913bc130c81f4c6cb004eddbdf1a3
SHA180eaa851d47a0aa67148e544882a3003b3f4742d
SHA2568ff356af97443bd2b028eb57f160a92c2a1ecab2d227977a87a221ae6409c4be
SHA5127aab507bc116aebf8202b96824489d48c90493acddfad9faac0013ed2d136db2a72a7269c7e4c79a17e051b7e30a62061ac954ed19bd35ec8ddc1a6cf3cc5e85