Analysis

  • max time kernel
    6s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2023 01:14

General

  • Target

    8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7.msi

  • Size

    8.7MB

  • MD5

    1170e2b02b92895d9db0be336d032d90

  • SHA1

    18f49619d69b057e81163bdf08eab5f355ce662c

  • SHA256

    8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7

  • SHA512

    bd1ceeee7928592e318b7f28b557bfcb97e4bb8f65f8c09001f19a746c7532f4f9d86aa54aab2866b5852921aa04a4f8de18e6c9109cc91c94c34879013c0134

  • SSDEEP

    196608:YeS5hV9/S6WXbfXlTrn7HZ5AQX3AveLukj1w9cNzvhXoZJ+:YdhVs6WXjX9HZ5AQX32WD/oZY

Malware Config

Extracted

Family

darkgate

Botnet

user_871236672

C2

http://adhufdauifadhj13.com

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    true

  • anti_debug

    true

  • anti_vm

    true

  • c2_port

    2351

  • check_disk

    false

  • check_ram

    true

  • check_xeon

    true

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    stanpttaHMuhnz

  • internal_mutex

    txtMut

  • minimum_disk

    40

  • minimum_ram

    6002

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    user_871236672

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Modifies file permissions 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2972
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2184
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 99535EB6245263D90F76031842ADDC2E
      2⤵
        PID:1216
        • C:\Windows\SysWOW64\ICACLS.EXE
          "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
          3⤵
          • Modifies file permissions
          PID:2548
        • C:\Windows\SysWOW64\EXPAND.EXE
          "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
          3⤵
            PID:2816
          • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\windbg.exe
            "C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\windbg.exe"
            3⤵
              PID:1600
              • \??\c:\tmpa\Autoit3.exe
                c:\tmpa\Autoit3.exe c:\tmpa\script.au3
                4⤵
                  PID:1456
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files"
                3⤵
                  PID:2080
                • C:\Windows\SysWOW64\ICACLS.EXE
                  "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\." /SETINTEGRITYLEVEL (CI)(OI)LOW
                  3⤵
                  • Modifies file permissions
                  PID:1304
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1944
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B0" "00000000000005A4"
              1⤵
                PID:2652

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files.cab

                Filesize

                8.4MB

                MD5

                c2861c23df5ad7a31c8ae622dc87f867

                SHA1

                0c50bc37cbf26c1e91f34b4a617f7ad663c78b13

                SHA256

                beee92357f4f194dcb2dda5b751939cb7218a090cdf05266c24ba52fcf51f013

                SHA512

                81d756790c8b2c9c3c8ef487968a977cd630bbcd7aa809519fc7358643981b6025556443de2672e9b6d5f8b43611ff771b8a36f99003985aaa068105585a4eb3

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\00004-~1.PNG

                Filesize

                1.1MB

                MD5

                2ccc17c1a5bb5e656e7f3bb09ff0beff

                SHA1

                05866cf7dd5fa99ea852b01c2791b30e7741ea19

                SHA256

                411b6ce9e97a4d828ab43dcf896f8ea09b5e9dc02874909f53ca1e0f10caeed2

                SHA512

                46b7362a2df870018707d89a7340ac0c07a2a357c504dbd944699c0231b4f984661b9f112b9d4869e55cf208ed5968f3ec5b5b35a956329679fb6e48ada7c4c5

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\00005-~1.PNG

                Filesize

                1.8MB

                MD5

                dee56d4f89c71ea6c4f1e75b82f2e9c9

                SHA1

                293ce531cddbf4034782d5dfed1e35c807d75c52

                SHA256

                a8f1ffb62d49d35a0f838f358614333e3d5d68ce5409fdfefcd1aa218d4639cf

                SHA512

                e8c38dc1d7a49d9cb919eae5294cc64379a933cdbd5427ed38c5f915271655f9bd6363e131f9d8a74ffdda23c7b155cc5200ddf999339ea611b98e74355faa0c

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\00006-~1.PNG

                Filesize

                1.8MB

                MD5

                173a98c6c7a166db7c3caa3a06fec06c

                SHA1

                3c562051f42353e72ba87b6f54744f6d0107df86

                SHA256

                212a80b3f8e68d00dbd8fc55fc8c4b30ee996348262d5d37e8b3f431a4b2fdad

                SHA512

                9dcd341937eff32762767d3538499d211f5a50fddb4e83d5d1afbeb87a5420c1fb9952ef2ecc744c460b7d53baa2bffbe99087a9f794d25ba78d1af61ea8b54d

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\00007-~1.PNG

                Filesize

                1.6MB

                MD5

                94b4895b7b8a60481393b7b8c22ad742

                SHA1

                902796c4aee78ab74e7ba5004625d797d83a8787

                SHA256

                f449409c8747d8e73ac7f8539c6e26d526ef51d267fed40eadce138389db5973

                SHA512

                d1ed6f5a1920eca041a683d71ac562058bc513877e3ae8be18888797d0713e25964c610428f9474d9b539097441002275e1f0023a565bd205cd4153ac282b61e

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\data.bin

                Filesize

                92KB

                MD5

                bb8c7df11b277155036fd6f62110d818

                SHA1

                c7f7413f4e525822be37b33817a1755a04fec4e8

                SHA256

                742f8df79f6dd2bd16d00d7235f655b32b687886cda485808d1c1762ba44336a

                SHA512

                a568949fcef56f0db85c5f452b345f4912c8ce9435915b9380b21f97bebbcc0961e9739b8c62fa5181d527e1852c72e3bd947a56dddb0a3031c6f2c9d67e1b1d

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\data2.bin

                Filesize

                2.0MB

                MD5

                148787dfd8c9b0d3c0681f0a984cbcf0

                SHA1

                0456d2fd54da6e9eaa239b9620efcf17c9cf95c5

                SHA256

                4f1c84df725ddff0403f24080baff45abc06a1191b43c00f9847d791b7b79488

                SHA512

                e0e4c8fc3953e48f253f3b762f6df6ec7bce0067e6f867eb1e8e5b3921ea7eada1993f8a173ae7f29103927b4e339374425b9f2a729da075fa142a8b5440e830

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\dbgeng.dll

                Filesize

                1.9MB

                MD5

                ed7798f01f00f2ce332053e85b73d512

                SHA1

                9dcbe0d54f61a0d5acda7e18dc47a247f598edd4

                SHA256

                b4401b1eae7f8a6c8bef9ba12daab302e41d25f5b8eff4b1a94bca0fc7990942

                SHA512

                9ce56059b2866cbb4662683bfa20565fead108dc4807ea095aeb6d4a86a6b47f6e2d6c7129097e5bf80b10a311217d0e3f75f65e3aa0058648a18faf92641bee

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\windbg.exe

                Filesize

                474KB

                MD5

                04ec4f58a1f4a87b5eeb1f4b7afc48e0

                SHA1

                58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

                SHA256

                bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

                SHA512

                5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\windbg.exe

                Filesize

                474KB

                MD5

                04ec4f58a1f4a87b5eeb1f4b7afc48e0

                SHA1

                58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

                SHA256

                bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

                SHA512

                5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\msiwrapper.ini

                Filesize

                1KB

                MD5

                5bbeb2a7393a4848d2d824217d307cb0

                SHA1

                f235e95c1793856e62fde0281228a2bfc8aecbb6

                SHA256

                9f7835545e58bfb5fdeae0c511d3091b9ad2d514fc139dd9344b6afb31c5174c

                SHA512

                e7a8138215eb2933522ffa76090f751ceaffb6c4beb63ddf3c7a8202f0dfcb1bfc5dee2eab7eca6e5447dc6883d22e3865baf319902cf66f0270d6c3027604b6

              • C:\Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\msiwrapper.ini

                Filesize

                1KB

                MD5

                5bbeb2a7393a4848d2d824217d307cb0

                SHA1

                f235e95c1793856e62fde0281228a2bfc8aecbb6

                SHA256

                9f7835545e58bfb5fdeae0c511d3091b9ad2d514fc139dd9344b6afb31c5174c

                SHA512

                e7a8138215eb2933522ffa76090f751ceaffb6c4beb63ddf3c7a8202f0dfcb1bfc5dee2eab7eca6e5447dc6883d22e3865baf319902cf66f0270d6c3027604b6

              • C:\Windows\Installer\MSI7955.tmp

                Filesize

                208KB

                MD5

                d82b3fb861129c5d71f0cd2874f97216

                SHA1

                f3fe341d79224126e950d2691d574d147102b18d

                SHA256

                107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

                SHA512

                244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

              • C:\tmpa\Autoit3.exe

                Filesize

                872KB

                MD5

                c56b5f0201a3b3de53e561fe76912bfd

                SHA1

                2a4062e10a5de813f5688221dbeb3f3ff33eb417

                SHA256

                237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                SHA512

                195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

              • \??\c:\tmpa\script.au3

                Filesize

                698KB

                MD5

                74de66e9523816a5b1dfbdb31b56cb3b

                SHA1

                9b0bd88932223c819d2c10d5739abdaf4f1a3cec

                SHA256

                91323b304dead6738f2652334e01bc2219751ea749501cf53f2f04573cd7cdd2

                SHA512

                21da2c017084db3e74447dd95478b4984a99494b8792ebde07fee9ed3c9114abe3491532bb89da47736098de8aa0e76e8313a28e26dca581f284fcc5b2e1df5a

              • \Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\dbgeng.dll

                Filesize

                1.9MB

                MD5

                ed7798f01f00f2ce332053e85b73d512

                SHA1

                9dcbe0d54f61a0d5acda7e18dc47a247f598edd4

                SHA256

                b4401b1eae7f8a6c8bef9ba12daab302e41d25f5b8eff4b1a94bca0fc7990942

                SHA512

                9ce56059b2866cbb4662683bfa20565fead108dc4807ea095aeb6d4a86a6b47f6e2d6c7129097e5bf80b10a311217d0e3f75f65e3aa0058648a18faf92641bee

              • \Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\windbg.exe

                Filesize

                474KB

                MD5

                04ec4f58a1f4a87b5eeb1f4b7afc48e0

                SHA1

                58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

                SHA256

                bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

                SHA512

                5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

              • \Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\windbg.exe

                Filesize

                474KB

                MD5

                04ec4f58a1f4a87b5eeb1f4b7afc48e0

                SHA1

                58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

                SHA256

                bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

                SHA512

                5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

              • \Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\windbg.exe

                Filesize

                474KB

                MD5

                04ec4f58a1f4a87b5eeb1f4b7afc48e0

                SHA1

                58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

                SHA256

                bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

                SHA512

                5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

              • \Users\Admin\AppData\Local\Temp\MW-33dc341a-7c2f-46d9-b3d8-b923b86b3a20\files\windbg.exe

                Filesize

                474KB

                MD5

                04ec4f58a1f4a87b5eeb1f4b7afc48e0

                SHA1

                58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

                SHA256

                bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

                SHA512

                5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

              • \Windows\Installer\MSI7955.tmp

                Filesize

                208KB

                MD5

                d82b3fb861129c5d71f0cd2874f97216

                SHA1

                f3fe341d79224126e950d2691d574d147102b18d

                SHA256

                107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

                SHA512

                244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

              • \tmpa\Autoit3.exe

                Filesize

                872KB

                MD5

                c56b5f0201a3b3de53e561fe76912bfd

                SHA1

                2a4062e10a5de813f5688221dbeb3f3ff33eb417

                SHA256

                237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                SHA512

                195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

              • memory/1456-113-0x0000000003690000-0x0000000003825000-memory.dmp

                Filesize

                1.6MB

              • memory/1456-114-0x0000000002DC0000-0x00000000031C0000-memory.dmp

                Filesize

                4.0MB

              • memory/1456-117-0x0000000002DC0000-0x00000000031C0000-memory.dmp

                Filesize

                4.0MB

              • memory/1600-104-0x0000000000E50000-0x0000000000EDA000-memory.dmp

                Filesize

                552KB

              • memory/1600-103-0x0000000000400000-0x0000000000600000-memory.dmp

                Filesize

                2.0MB

              • memory/1600-96-0x0000000000E50000-0x0000000000EDA000-memory.dmp

                Filesize

                552KB