Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

c36f35e271...29.exe

windows7-x64

10

c36f35e271...29.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    13s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 10:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe

  • Size

    405KB

  • MD5

    52fc04a1017bff949d2531942491e7d9

  • SHA1

    0f23ac4f5dc0603894374026349d7db0f870ee91

  • SHA256

    c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229

  • SHA512

    920905dc5d7c25daf2ba38daeeeab8ffe883023905ecb166f585346b012caeb3629e12400ca0df4c24e23d2abdea8081f7272d3b1385121ffc301f2982a10c85

  • SSDEEP

    12288:0UEpOEWzuYzy/Bda9AlxhwcySTcth/4N:0fOEWjyZda9uhwlSIf4

Score
10/10
darkgatecivilian1337stealer

Malware Config

Extracted

Family

darkgate

Version

5.2.4

Botnet

civilian1337

C2

http://185.130.227.202

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    false

  • anti_debug

    true

  • anti_vm

    false

  • c2_port

    2351

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    true

  • crypto_key

    VPsTDMdPronzYs

  • internal_mutex

    txtMut

  • minimum_ram

    4096

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    civilian1337

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate
  • Detect DarkGate stealer 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
    "C:\Users\Admin\AppData\Local\Temp\c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3924

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    249.110.86.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    249.110.86.104.in-addr.arpa
    IN PTR
    Response
    249.110.86.104.in-addr.arpa
    IN PTR
    a104-86-110-249deploystaticakamaitechnologiescom
  • flag-us
    DNS
    76.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    76.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.66.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.66.18.2.in-addr.arpa
    IN PTR
    Response
    9.66.18.2.in-addr.arpa
    IN PTR
    a2-18-66-9deploystaticakamaitechnologiescom
  • flag-us
    DNS
    202.110.86.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    202.110.86.104.in-addr.arpa
    IN PTR
    Response
    202.110.86.104.in-addr.arpa
    IN PTR
    a104-86-110-202deploystaticakamaitechnologiescom
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • 185.130.227.202:2351
    208 B
     4
  • 185.130.227.202:8080
    208 B
     4
  • 185.130.227.202:2351
    156 B
     3
  • 185.130.227.202:8080
    156 B
     3
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    249.110.86.104.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    249.110.86.104.in-addr.arpa

  • 8.8.8.8:53
    76.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    76.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    183.59.114.20.in-addr.arpa

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    9.66.18.2.in-addr.arpa
    dns
    68 B
     129 B
     1
    1

    DNS Request

    9.66.18.2.in-addr.arpa

  • 8.8.8.8:53
    202.110.86.104.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    202.110.86.104.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3924-3-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

    Download

  • memory/3924-4-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

    Download

  • memory/3924-5-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

    Download

  • memory/3924-7-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.