Overview

overview

10

Static

static

1

build-x64.msi

windows7-x64

10

build-x64.msi

windows10-1703-x64

10

build-x64.msi

windows10-2004-x64

10

build-x64.msi

windows11-21h2-x64

10

Resubmissions

12/02/2024, 17:33

240212-v48edscc4210

12/02/2024, 16:54

240212-veh37sca4510

Analysis

  • max time kernel
    294s
  • max time network
    296s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/02/2024, 17:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    build-x64.msi
  • Size 5.8MB
  • Sample240212-v48edscc42
  • SHA256 693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
darkgatediscoverystealer

Malware Config

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate
  • Detect DarkGate stealer 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\build-x64.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1968
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3672
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C4764A1203830AE12F94F9BD03C1774E
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        PID:1404
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:1632
      • C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\files\iTunesHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\files\iTunesHelper.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4256
        • \??\c:\temp\Autoit3.exe
          "c:\temp\Autoit3.exe" c:\temp\script.a3x
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:3496
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\files"
        3⤵
          PID:4388
        • C:\Windows\SysWOW64\ICACLS.EXE
          "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\." /SETINTEGRITYLEVEL (CI)(OI)LOW
          3⤵
          • Modifies file permissions
          PID:4212
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3800
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4348

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
          • Size 1KB
          • SHA256 5c6b76cdbcf198cd8c9cc32c0b6c23c542d413423c8f269cac55831d1fbf93e9
          • MD5 SHA1 SHA512
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 1KB
          • SHA256 4c03595f61412f2b4a8f0152b099db02102a8be4d0310977920bb602df299efc
          • MD5 SHA1 SHA512
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5
          • Size 540B
          • SHA256 61f7152842252d60578abf3e544213e4536f105394f045880fa04cf83b513616
          • MD5 SHA1 SHA512
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 536B
          • SHA256 11ba856fafc79d3e6db3c56732961f9a9942470b6ee71eb1e7ec912c01e68ac7
          • MD5 SHA1 SHA512
          Submit Download

          files.cab
          • Path C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\files.cab
          • Size 5.6MB
          • SHA256 599ab65935afd40c3bc7f1734cbb8f3c8c7b4b16333b994472f34585ebebe882
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CoreFoundation.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\files\CoreFoundation.dll
          • Size 3.6MB
          • SHA256 f049356bb6a8a7cd82a58cdc9e48c492992d91088dda383bd597ff156d8d2929
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          iTunesHelper.exe
          • Path C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\files\iTunesHelper.exe
          • Size 358KB
          • SHA256 0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\files\sqlite3.dll
          • Size 1.6MB
          • SHA256 17158c1a804bbf073d7f0f64a9c974312b3967a43bdc029219ab62545b94e724
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msiwrapper.ini
          • Path C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\msiwrapper.ini
          • Size 1KB
          • SHA256 7b9f01fc5ccb64814e11e8da8d4577385f36650ef437e116efe348519f5131e0
          • MD5 SHA1 SHA512
          Submit Download

          msiwrapper.ini
          • Path C:\Users\Admin\AppData\Local\Temp\MW-b3e5b328-0948-4ed3-9a06-6d627b46a811\msiwrapper.ini
          • Size 1KB
          • SHA256 deed183cb7b4f2f906c4ddfd6be3886c659c36b6f12be0d1e4055f8b4ca8d35a
          • MD5 SHA1 SHA512
          Submit Download

          MSI700.tmp
          • Path C:\Windows\Installer\MSI700.tmp
          • Size 208KB
          • SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Autoit3.exe
          • Path C:\temp\Autoit3.exe
          • Size 872KB
          • SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 10.0MB
          • SHA256 a1148fda1ea98461905e0a93735058cffcb2f436b937305b6b046492778aecc0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {41a38026-d62a-4416-a0af-b7b27cba05a0}_OnDiskSnapshotProp
          • Path \??\Volume{11f480d7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{41a38026-d62a-4416-a0af-b7b27cba05a0}_OnDiskSnapshotProp
          • Size 5KB
          • SHA256 62b8e11c24e406f099b5434441640fd5d283d8819f773c26ab613b54f7f3a00c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          script.a3x
          • Path \??\c:\temp\script.a3x
          • Size 473KB
          • SHA256 2296f929340976c680d199ce8e47bd7136d9f4c1f7abc9df79843e094f894236
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          test.txt
          • Path \??\c:\temp\test.txt
          • Size 76B
          • SHA256 03bed76f17b8574d05e84b81f81c09a33b1ae1555c2caf4783e059b689879ab6
          • MD5 SHA1 SHA512
          Submit Download

          memory/3496-109-0x0000000005250000-0x0000000006220000-memory.dmp
          Download

          memory/3496-110-0x0000000006750000-0x0000000006AAC000-memory.dmp
          Download

          memory/3496-111-0x0000000006750000-0x0000000006AAC000-memory.dmp
          Download

          memory/4256-99-0x000001F22E9D0000-0x000001F22EB70000-memory.dmp
          Download

          memory/4256-114-0x00000000660C0000-0x0000000066468000-memory.dmp
          Download

          memory/4256-116-0x000001F22E9D0000-0x000001F22EB70000-memory.dmp
          Download