Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 22:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbf2ceb3c5ebc6f1d8c09f3098176ded9503800cba77cfefa25ea9e0a8085ae3.dll
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
cbf2ceb3c5ebc6f1d8c09f3098176ded9503800cba77cfefa25ea9e0a8085ae3.dll
-
Size
2.4MB
-
MD5
cd8fff708a1a99a4d3b5bfec49ae278a
-
SHA1
367050b2323952b52a11fcb55dd359e59637a884
-
SHA256
cbf2ceb3c5ebc6f1d8c09f3098176ded9503800cba77cfefa25ea9e0a8085ae3
-
SHA512
80485ca1ee306b2f9e6b18d747bfc148c3f69f98f58ade8d675babbabff20e4d387a3bb83e1ab05aff166a29df4eefeed8df989d2c8af339e68b4d365064eb68
-
SSDEEP
49152:fLRISHEkoozx3u4+iTjaipEluOhYBUvqQENPvGzf:fLRZzx3nql1UUSQENPvE
Malware Config
Extracted
Family
darkgate
Botnet
seal1
C2
193.142.146.203
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
AVUHIwtf
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
false
-
username
seal1
Signatures
-
Detect DarkGate stealer 8 IoCs
resource yara_rule behavioral2/memory/1328-3-0x0000000010000000-0x0000000010281000-memory.dmp family_darkgate_v6 behavioral2/memory/1328-1-0x0000000010000000-0x0000000010281000-memory.dmp family_darkgate_v6 behavioral2/memory/3472-5-0x00000000004C0000-0x0000000000532000-memory.dmp family_darkgate_v6 behavioral2/memory/3472-6-0x00000000004C0000-0x0000000000532000-memory.dmp family_darkgate_v6 behavioral2/memory/3472-7-0x00000000004C0000-0x0000000000532000-memory.dmp family_darkgate_v6 behavioral2/memory/3472-9-0x00000000004C0000-0x0000000000532000-memory.dmp family_darkgate_v6 behavioral2/memory/3472-10-0x00000000004C0000-0x0000000000532000-memory.dmp family_darkgate_v6 behavioral2/memory/3472-12-0x00000000004C0000-0x0000000000532000-memory.dmp family_darkgate_v6 -
Blocklisted process makes network request 64 IoCs
flow pid Process 19 3472 rundll32.exe 21 3472 rundll32.exe 22 3472 rundll32.exe 23 3472 rundll32.exe 24 3472 rundll32.exe 25 3472 rundll32.exe 26 3472 rundll32.exe 27 3472 rundll32.exe 28 3472 rundll32.exe 29 3472 rundll32.exe 30 3472 rundll32.exe 31 3472 rundll32.exe 32 3472 rundll32.exe 33 3472 rundll32.exe 34 3472 rundll32.exe 35 3472 rundll32.exe 36 3472 rundll32.exe 37 3472 rundll32.exe 38 3472 rundll32.exe 39 3472 rundll32.exe 40 3472 rundll32.exe 41 3472 rundll32.exe 42 3472 rundll32.exe 43 3472 rundll32.exe 44 3472 rundll32.exe 45 3472 rundll32.exe 46 3472 rundll32.exe 47 3472 rundll32.exe 48 3472 rundll32.exe 49 3472 rundll32.exe 50 3472 rundll32.exe 51 3472 rundll32.exe 54 3472 rundll32.exe 58 3472 rundll32.exe 62 3472 rundll32.exe 64 3472 rundll32.exe 68 3472 rundll32.exe 69 3472 rundll32.exe 70 3472 rundll32.exe 72 3472 rundll32.exe 73 3472 rundll32.exe 74 3472 rundll32.exe 75 3472 rundll32.exe 76 3472 rundll32.exe 77 3472 rundll32.exe 78 3472 rundll32.exe 79 3472 rundll32.exe 80 3472 rundll32.exe 81 3472 rundll32.exe 82 3472 rundll32.exe 83 3472 rundll32.exe 84 3472 rundll32.exe 85 3472 rundll32.exe 86 3472 rundll32.exe 87 3472 rundll32.exe 88 3472 rundll32.exe 89 3472 rundll32.exe 90 3472 rundll32.exe 91 3472 rundll32.exe 92 3472 rundll32.exe 93 3472 rundll32.exe 94 3472 rundll32.exe 95 3472 rundll32.exe 96 3472 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1328 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3472 rundll32.exe 3472 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3472 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3088 wrote to memory of 1328 3088 rundll32.exe 85 PID 3088 wrote to memory of 1328 3088 rundll32.exe 85 PID 3088 wrote to memory of 1328 3088 rundll32.exe 85 PID 1328 wrote to memory of 3472 1328 rundll32.exe 96 PID 1328 wrote to memory of 3472 1328 rundll32.exe 96 PID 1328 wrote to memory of 3472 1328 rundll32.exe 96 PID 1328 wrote to memory of 3472 1328 rundll32.exe 96 PID 1328 wrote to memory of 3472 1328 rundll32.exe 96 PID 1328 wrote to memory of 3472 1328 rundll32.exe 96
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbf2ceb3c5ebc6f1d8c09f3098176ded9503800cba77cfefa25ea9e0a8085ae3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbf2ceb3c5ebc6f1d8c09f3098176ded9503800cba77cfefa25ea9e0a8085ae3.dll,#12⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3472
-
-