Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2023 00:09
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20230712-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1.exe
-
Size
872KB
-
MD5
c56b5f0201a3b3de53e561fe76912bfd
-
SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417
-
SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
-
SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
SSDEEP
12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Malware Config
Extracted
Family
darkgate
C2
http://107.181.161.20
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 30 IoCs
description pid Process procid_target PID 468 created 2332 468 1.exe 52 PID 468 created 3740 468 1.exe 16 PID 468 created 1708 468 1.exe 37 PID 468 created 1708 468 1.exe 37 PID 468 created 3672 468 1.exe 28 PID 468 created 3672 468 1.exe 28 PID 468 created 1708 468 1.exe 37 PID 468 created 3672 468 1.exe 28 PID 468 created 3820 468 1.exe 27 PID 468 created 2332 468 1.exe 52 PID 468 created 3820 468 1.exe 27 PID 468 created 3740 468 1.exe 16 PID 468 created 3820 468 1.exe 27 PID 468 created 560 468 1.exe 85 PID 468 created 2548 468 1.exe 49 PID 468 created 1708 468 1.exe 37 PID 468 created 3672 468 1.exe 28 PID 468 created 1708 468 1.exe 37 PID 468 created 2548 468 1.exe 49 PID 468 created 2332 468 1.exe 52 PID 468 created 1708 468 1.exe 37 PID 468 created 2380 468 1.exe 51 PID 468 created 2548 468 1.exe 49 PID 468 created 2332 468 1.exe 52 PID 468 created 2332 468 1.exe 52 PID 468 created 560 468 1.exe 85 PID 468 created 2548 468 1.exe 49 PID 1164 created 3820 1164 AcroRd32Info.exe 27 PID 1164 created 3820 1164 AcroRd32Info.exe 27 PID 1164 created 2548 1164 AcroRd32Info.exe 49 -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\acbeeea.lnk AcroRd32Info.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings 1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 468 1.exe 1164 AcroRd32Info.exe 1164 AcroRd32Info.exe 1164 AcroRd32Info.exe 1164 AcroRd32Info.exe 1164 AcroRd32Info.exe 1164 AcroRd32Info.exe 1164 AcroRd32Info.exe 1164 AcroRd32Info.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 560 468 1.exe 85 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89 PID 468 wrote to memory of 1164 468 1.exe 89
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3740
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3820
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe"2⤵PID:560
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3672
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1708
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2548
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe"2⤵PID:5052
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\1.exeC:\Users\Admin\AppData\Local\Temp\1.exe 2.au31⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:468
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134B
MD5251189ca0c2f7f5a69edcd297fefc0c9
SHA1fca11af3ed7a05391cec6c605df97b51b726ff6f
SHA25641c30427ec3975b5e770d008432192f1875580f87f0cee3fe7df0c0e79436e1c
SHA51299a6666ac488e2d7ff23ee14212943b01bcdee59679cdb9082a8b02a9f6c627dd16df996fa7f7f09363984228d6fcee3d03c15e577937095b390bc4f8046a0db
-
Filesize
134B
MD5251189ca0c2f7f5a69edcd297fefc0c9
SHA1fca11af3ed7a05391cec6c605df97b51b726ff6f
SHA25641c30427ec3975b5e770d008432192f1875580f87f0cee3fe7df0c0e79436e1c
SHA51299a6666ac488e2d7ff23ee14212943b01bcdee59679cdb9082a8b02a9f6c627dd16df996fa7f7f09363984228d6fcee3d03c15e577937095b390bc4f8046a0db
-
Filesize
777KB
MD50e3913bc130c81f4c6cb004eddbdf1a3
SHA180eaa851d47a0aa67148e544882a3003b3f4742d
SHA2568ff356af97443bd2b028eb57f160a92c2a1ecab2d227977a87a221ae6409c4be
SHA5127aab507bc116aebf8202b96824489d48c90493acddfad9faac0013ed2d136db2a72a7269c7e4c79a17e051b7e30a62061ac954ed19bd35ec8ddc1a6cf3cc5e85