Analysis
-
max time kernel
567s -
max time network
377s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
07-02-2024 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Run-AU3-1.bat
Resource
win10-20231215-en
windows10-1703-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
Run-AU3-1.bat
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
600 seconds
General
-
Target
Run-AU3-1.bat
-
Size
81B
-
MD5
599f4da678f672c247d123cad4816fbd
-
SHA1
b93ee64d44e2091269bbdd41b2f2ded0008e705c
-
SHA256
421c134cfd30e84b33d94fe9b8d3755ba207fc0eba1aee11e3144b245c745b43
-
SHA512
1ee9a7862cdffd2a86f57cc8709faa7fbeda5545d9a178674086b513a19dc86f06ed66113689c7c5a376749307b5ec679d9e97809890eb373e6a745cd1d2ab89
Malware Config
Signatures
-
Detect DarkGate stealer 2 IoCs
resource yara_rule behavioral1/memory/1880-3-0x00000000064F0000-0x000000000683E000-memory.dmp family_darkgate_v6 behavioral1/memory/1880-4-0x00000000064F0000-0x000000000683E000-memory.dmp family_darkgate_v6 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3580 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe 436 hollows_hunter64.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe Token: SeDebugPrivilege 436 hollows_hunter64.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4248 wrote to memory of 1880 4248 cmd.exe 75 PID 4248 wrote to memory of 1880 4248 cmd.exe 75 PID 4248 wrote to memory of 1880 4248 cmd.exe 75 PID 4248 wrote to memory of 3580 4248 cmd.exe 76 PID 4248 wrote to memory of 3580 4248 cmd.exe 76 PID 4248 wrote to memory of 436 4248 cmd.exe 77 PID 4248 wrote to memory of 436 4248 cmd.exe 77
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Run-AU3-1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\Autoit3.exeAutoit3.exe script.au32⤵
- Checks processor information in registry
PID:1880
-
-
C:\Windows\system32\timeout.exetimeout /t 30 /nobreak2⤵
- Delays execution with timeout.exe
PID:3580
-
-
C:\Users\Admin\AppData\Local\Temp\hollows_hunter64.exehollows_hunter64.exe /loop /quiet2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436
-