Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/03/2024, 15:16

General

  • Target

    nrwncpwo.ps1

  • Size

    350B

  • MD5

    4dcabdc088c563712db30a16ed19dd52

  • SHA1

    5758984a8840f3af5624e1149b306e8efd9ae483

  • SHA256

    9353635f565f1a3b0c4caa28f268f30271e12709d921ea87969cd4e7d2b8c642

  • SHA512

    a84614600f27918ac5490360873128bf6a7b6a8181efc64608b1045913a9ddd27f18e1b3d175e68e2f64d221a08fd160b122a0e4f5540e5bb828c5be9a60e40f

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

badbutperfect.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    WZqqpfdY

  • minimum_disk

    50

  • minimum_ram

    4000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 2 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\nrwncpwo.ps1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\rimz\AutoHotkey.exe
      "C:\rimz\AutoHotkey.exe" script.ahk
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      PID:1476
    • C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:/rimz
      2⤵
      • Views/modifies file attributes
      PID:3756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvdeafpv.jka.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\rimz\AutoHotkey.exe

    Filesize

    892KB

    MD5

    a59a2d3e5dda7aca6ec879263aa42fd3

    SHA1

    312d496ec90eb30d5319307d47bfef602b6b8c6c

    SHA256

    897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb

    SHA512

    852972ca4d7f9141ea56d3498388c61610492d36ea7d7af1b36d192d7e04dd6d9bc5830e0dcb0a5f8f55350d4d8aaac2869477686b03f998affbac6321a22030

  • C:\rimz\script.ahk

    Filesize

    54KB

    MD5

    f02f0bba1f1f678da41abafd02f4c545

    SHA1

    c40b80bc4947d4ac52bc9c17d6d218b1fa9cd452

    SHA256

    5aac7d31149048763e688878c3910ae4881826db80e078754f5d08f2c1f39572

    SHA512

    8b56e388781a9fb855d8352f2cf175a7e0c5bb36bacd79be719ffa0c9f4c9f6e852bd460b6e9b0b7ea47ff38aa803e43a2366bf7a2686905c05bdd9e231b5b22

  • C:\rimz\test.txt

    Filesize

    687KB

    MD5

    283b7361d6c8e6c345f23c04dd71a46b

    SHA1

    2cc206a4be8277a675a5294f4cd8d2288099ecf9

    SHA256

    a78ae5fb01f6d5dd9f455a3d98c56cea0c6804f620568276aa520d5a20a8e6ab

    SHA512

    dd54c520def9b12ca0bee4651c9c7794f13d70aedf4b8e91dae72f5e8556adf1737366833ed2697de3c0a70f362d0a59d5969493716dbb8ad1d2c37dc3b15065

  • memory/1476-30-0x0000000002B10000-0x0000000002B83000-memory.dmp

    Filesize

    460KB

  • memory/1476-32-0x0000000002B10000-0x0000000002B83000-memory.dmp

    Filesize

    460KB

  • memory/1508-9-0x000001BC6D9D0000-0x000001BC6D9F2000-memory.dmp

    Filesize

    136KB

  • memory/1508-10-0x00007FFD6A3A0000-0x00007FFD6AE61000-memory.dmp

    Filesize

    10.8MB

  • memory/1508-11-0x000001BC6DA50000-0x000001BC6DA60000-memory.dmp

    Filesize

    64KB

  • memory/1508-12-0x000001BC6DA50000-0x000001BC6DA60000-memory.dmp

    Filesize

    64KB

  • memory/1508-27-0x00007FFD6A3A0000-0x00007FFD6AE61000-memory.dmp

    Filesize

    10.8MB