Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2023, 00:13

General

  • Target

    1.exe

  • Size

    872KB

  • MD5

    c56b5f0201a3b3de53e561fe76912bfd

  • SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

  • SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

  • SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • SSDEEP

    12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01

Score
10/10

Malware Config

Extracted

Family

darkgate

C2

http://107.181.161.20

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
      • C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe
        "C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        PID:2488
      • C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe
        "C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1748
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      C:\Users\Admin\AppData\Local\Temp\1.exe 3.au3
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2476

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\heekeah\acbdfda\dbggaec

      Filesize

      134B

      MD5

      45b0c7b9769f142c558502bae6e7fb9a

      SHA1

      7dc92c892acd0018ae0041201a1a91a47055ef65

      SHA256

      22429ff2bf212ea5052d66ce0762048796b5867fca0351ddc0ddc522621d6c9b

      SHA512

      b4fa9d798c0152424970b1f681fcf12137632bacab370df57dccb2499311bfc01a8dcdea0cf21b32ff7243b768dfc94dff06c334c2be32dfd4e10b8e4f2f3431

    • C:\ProgramData\heekeah\acbdfda\dbggaec

      Filesize

      134B

      MD5

      45b0c7b9769f142c558502bae6e7fb9a

      SHA1

      7dc92c892acd0018ae0041201a1a91a47055ef65

      SHA256

      22429ff2bf212ea5052d66ce0762048796b5867fca0351ddc0ddc522621d6c9b

      SHA512

      b4fa9d798c0152424970b1f681fcf12137632bacab370df57dccb2499311bfc01a8dcdea0cf21b32ff7243b768dfc94dff06c334c2be32dfd4e10b8e4f2f3431

    • \??\c:\temp\kcbefha.au3

      Filesize

      776KB

      MD5

      5892ff480896da2f5c2e52a8dccb1446

      SHA1

      7d89c0b2ed8613f0ea23a2200b9a66d8b316f7af

      SHA256

      1d981f5c19ba3f2be6be51685f211ed80b28fc31dd1de7b7797e09a611e893c5

      SHA512

      6a836325d3f233cd04eca1de36e695f238005066b55d93d6526e90a588466da2812b84407095a7fb19f8e1051b66c04457886a239d481ab48563507eb85c5213

    • memory/1748-629-0x00000000000F0000-0x00000000000F1000-memory.dmp

      Filesize

      4KB

    • memory/1748-627-0x00000000000B0000-0x00000000000B1000-memory.dmp

      Filesize

      4KB

    • memory/1748-1226-0x0000000010490000-0x000000001050E000-memory.dmp

      Filesize

      504KB

    • memory/1748-1221-0x0000000010490000-0x000000001050E000-memory.dmp

      Filesize

      504KB

    • memory/2476-19-0x0000000000630000-0x0000000000A30000-memory.dmp

      Filesize

      4.0MB

    • memory/2476-24-0x0000000003220000-0x00000000033FA000-memory.dmp

      Filesize

      1.9MB

    • memory/2476-611-0x0000000003220000-0x00000000033FA000-memory.dmp

      Filesize

      1.9MB

    • memory/2476-1-0x0000000000630000-0x0000000000A30000-memory.dmp

      Filesize

      4.0MB

    • memory/2476-6-0x0000000003220000-0x00000000033FA000-memory.dmp

      Filesize

      1.9MB

    • memory/2476-3-0x0000000003220000-0x00000000033FA000-memory.dmp

      Filesize

      1.9MB

    • memory/2476-2-0x0000000002A00000-0x0000000002AF5000-memory.dmp

      Filesize

      980KB

    • memory/2488-8-0x00000000000A0000-0x00000000000A1000-memory.dmp

      Filesize

      4KB

    • memory/2488-646-0x0000000010410000-0x000000001048E000-memory.dmp

      Filesize

      504KB

    • memory/2488-610-0x0000000010410000-0x000000001048E000-memory.dmp

      Filesize

      504KB

    • memory/2488-9-0x00000000000C0000-0x00000000000C1000-memory.dmp

      Filesize

      4KB