Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • submitted
    14/02/2024, 13:11

General

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

prodomainnameeforappru.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    443

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    WeBiMyRU

  • minimum_disk

    50

  • minimum_ram

    7000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Darkgate family
  • Detect DarkGate stealer 3 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs

    Using AutoIT for possible automate script.

  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\build-x64.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2656
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:364
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E9BA5F6EAA20A386FC38FCF832DEAE05
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:2344
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2020
      • C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files\iTunesHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files\iTunesHelper.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2040
        • \??\c:\temp\Autoit3.exe
          "c:\temp\Autoit3.exe" c:\temp\script.a3x
          4⤵
          • Command and Scripting Interpreter: AutoIT
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:2988
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1784
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\." /SETINTEGRITYLEVEL (CI)(OI)LOW
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:2088
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2784
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000570" "0000000000000590"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

    Filesize

    1KB

    MD5

    e94fb54871208c00df70f708ac47085b

    SHA1

    4efc31460c619ecae59c1bce2c008036d94c84b8

    SHA256

    7b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86

    SHA512

    2e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    198a9e62eec29db1305d1af420817675

    SHA1

    9e4d6a177913b0d6df45705398bb380bf30fcd7a

    SHA256

    17a720bac6aae48ec75bf565360e747e52299440622d77a9236bc00bfd316f02

    SHA512

    9a93aaca1c6a06694c379d51112e9a321f5a15f73e2d8cd9d3d857b4138026d193b6cdf231c3bde6043703671b4db43ea9a17a9a6f52c0a696bdb70db88455a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

    Filesize

    264B

    MD5

    07087cb3e8f58a7b77ac935229dd6817

    SHA1

    9a89377414dec3acb1d3cd1bc1456e7ce2fe6297

    SHA256

    72d648380814c66d864ff963eda582c51ce0640bd8df0e84f807f167814602f6

    SHA512

    7b69dd869911666c58104dff46c6dc62475e7d6d0a732026ab3cf594dd8467bad753e1deefa9931f56b8464540d43296a9e35645bc09a0edd455508506de88a8

  • C:\Users\Admin\AppData\Local\Temp\Cab515D.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files.cab

    Filesize

    5.6MB

    MD5

    d339565d7c5224c45092b3aaeeb3797f

    SHA1

    c85565693714583e57fb9addb64368cc87288efa

    SHA256

    359e387871378831eb1293f41b54436abc6357733d1a573f0caff90ab1cbf07d

    SHA512

    14b3cb62aa99f53a8205783297285b38268306d4876ebdc65ab42d2c7c5613dc4b7010d3f25f2ad60747e136ff5939dca8f6a986f7161f27c0d791f4e874062b

  • C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files\CoreFoundation.dll

    Filesize

    3.6MB

    MD5

    b4677a50c291d7c5a7f9f1b80f39a37f

    SHA1

    76d183107f9a8f89f09e25149e6e3de777b25d5a

    SHA256

    c2d43d768cebcf63e8d0c3ae8ffd2cd5070e4ac656a132b63d5e7372cef69c62

    SHA512

    bb2a3bb016cca60bd5f8a33773752e8f88bae764a6497eaaccf563da8607805b5723b30135c001f2fbc20c628e75c099410d9fd09b375c3d2901b6e7f70ba356

  • C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files\iTunesHelper.exe

    Filesize

    358KB

    MD5

    ed6a1c72a75dee15a6fa75873cd64975

    SHA1

    67a15ca72e3156f8be6c46391e184087e47f4a0d

    SHA256

    0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda

    SHA512

    256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03

  • C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files\sqlite3.dll

    Filesize

    1.6MB

    MD5

    ce6e163809f5e817ef0c259672f7a1cd

    SHA1

    123e2f032b2fc45d6d9fe482756243ed61137476

    SHA256

    28ead67d2352ddd11f963e8b23930905ecbaff371162dfdae5ed096f62eb3d79

    SHA512

    07766db4cf023bf059415a58a9e1384acb39260ba71587b4eadb99f84d307c0ab70f76390894ab786a6461a0c809f8e9fe435f7bf9b334a369a178c54b295229

  • C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\msiwrapper.ini

    Filesize

    396B

    MD5

    fb11a2b6d4de09417d1209ea1b9b0267

    SHA1

    12e505b8c60b117fb546de71cccb56405db0d2eb

    SHA256

    33274794938036eb57c83136a539127b1782174645755d7a1bc683cfe24387df

    SHA512

    7e4451537a60546062ec1dd982dc9f9001ead9a715a2cacdfac2770ef0f0f3a3805d23f8c1f1f1d831ef1dc0d4e22f00ec6fc49d76d79c78b16bba6d90690fb2

  • C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\msiwrapper.ini

    Filesize

    1KB

    MD5

    8137febdeff603a2745a3fef8091f3f0

    SHA1

    a98b8ac550cdfbb38286faa35d78a9150b628942

    SHA256

    bf587d46f3397834443938a31446c9edad9755946820cfb2cf8486edec83dc9f

    SHA512

    e02322aa57a3dda92d11b9c5a7f715d900cb88619baf495d4c11f595fb2d39ce47f1beb86c4072f2588fb525f05d8bd8a9d49b4cf67f7cf36e7551b314e0e918

  • C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\msiwrapper.ini

    Filesize

    1KB

    MD5

    c245fb0290d0b30100ad722b90011f36

    SHA1

    49d31e78ae5875451968327076777c770b7c2497

    SHA256

    20d4a9e6602373e65fc7ff6bafc83f5712d62790abfdcead11371fd4186f896d

    SHA512

    c770d6d6f2bd21e344203b2bdccf42a3d99d5be97ff4c378f303458b242dbf3553c7a00eb0864a832aa41d1fb72566efd083236a18f4af083ed9e5d28be9b4c7

  • C:\Users\Admin\AppData\Local\Temp\Tar518F.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Windows\Installer\MSIA6F8.tmp

    Filesize

    208KB

    MD5

    d82b3fb861129c5d71f0cd2874f97216

    SHA1

    f3fe341d79224126e950d2691d574d147102b18d

    SHA256

    107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

    SHA512

    244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

  • C:\temp\Autoit3.exe

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • \??\c:\temp\script.a3x

    Filesize

    474KB

    MD5

    6354b28ac4bc8fa465d80c3ea3893116

    SHA1

    0eea737ad0a1a0cb5c3f14279a05d1fba6c6216d

    SHA256

    9515b7b3ebe97e51842be2e91241f0332916d6ec8aecb767ba418de4d21f57f7

    SHA512

    6150a7b646326f01118535c2469628de79e20b7461dccf44a2311d0c1f7e4ed2d8523e7671e26d9c843fabce2946ea33adf4cc4e6acfd3216e1e06cdc1efa53b

  • \??\c:\temp\test.txt

    Filesize

    76B

    MD5

    45306f5622da212035662680f1c09e0e

    SHA1

    a89ae25df7b6bc8a30c4dcfdc267cf912e17f1bb

    SHA256

    2a5eaa4fb540232306ee036ed870369570744b34d8bd17743293e4763d19933e

    SHA512

    99c9a4c77b346cf95930575fdb6a0c7ef4fe3cc75831e8f4c5d8114d0b35ff8c7fa6ca4f4dca6b34b53bd133766565318da0904fb467f88a1d7f47d0577115b0

  • memory/2040-336-0x0000000002330000-0x00000000024D0000-memory.dmp

    Filesize

    1.6MB

  • memory/2040-343-0x0000000074420000-0x00000000747C8000-memory.dmp

    Filesize

    3.7MB

  • memory/2040-346-0x0000000002330000-0x00000000024D0000-memory.dmp

    Filesize

    1.6MB

  • memory/2988-350-0x0000000003820000-0x00000000047F0000-memory.dmp

    Filesize

    15.8MB

  • memory/2988-352-0x0000000004CA0000-0x0000000004FFB000-memory.dmp

    Filesize

    3.4MB

  • memory/2988-355-0x0000000004CA0000-0x0000000004FFB000-memory.dmp

    Filesize

    3.4MB