Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 09:52
Static task
static1
Behavioral task
behavioral1
Sample
6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70.msi
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
General
-
Target
6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70.msi
-
Size
1.8MB
-
MD5
247a8cc39384e93d258360a11381000f
-
SHA1
23893f035f8564dfea5030b9fdd54120d96072bb
-
SHA256
6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70
-
SHA512
336eca9569c0072e92ce16743f47ba9d6be06390a196f8e81654d6a42642ff5c99e423bfed00a8396bb0b037d5b54df8c3bde53757646e7e1a204f3be271c998
-
SSDEEP
24576:ftncpVGP4I9FsEsyt8l+E+s1tB7parWM0+AL5QgZQvUXtAqlU0ZyMRp:epUP59FBJZEH1X1arF0vN/nX
Malware Config
Extracted
Family
darkgate
C2
http://80.66.88.145
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
7891
-
check_disk
true
-
check_ram
true
-
check_xeon
false
-
crypter_au3
true
-
crypter_dll
false
-
crypter_raw_stub
false
-
crypto_key
bIWRRCGvGiXOga
-
internal_mutex
bbbGcB
-
minimum_disk
50
-
minimum_ram
4096
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
Signatures
-
Detect DarkGate stealer 1 IoCs
resource yara_rule behavioral1/memory/2028-77-0x0000000003120000-0x00000000032F9000-memory.dmp family_darkgate_v6 -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2156 ICACLS.EXE 2756 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\f762c00.msi msiexec.exe File created C:\Windows\Installer\f762c01.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2D38.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSI3140.tmp msiexec.exe File opened for modification C:\Windows\Installer\f762c01.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f762c00.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI313F.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE -
Executes dropped EXE 1 IoCs
pid Process 2028 Autoit3.exe -
Loads dropped DLL 6 IoCs
pid Process 2276 MsiExec.exe 2276 MsiExec.exe 2276 MsiExec.exe 2276 MsiExec.exe 2276 MsiExec.exe 2276 MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1656 msiexec.exe 1656 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 1900 msiexec.exe Token: SeIncreaseQuotaPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeSecurityPrivilege 1656 msiexec.exe Token: SeCreateTokenPrivilege 1900 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1900 msiexec.exe Token: SeLockMemoryPrivilege 1900 msiexec.exe Token: SeIncreaseQuotaPrivilege 1900 msiexec.exe Token: SeMachineAccountPrivilege 1900 msiexec.exe Token: SeTcbPrivilege 1900 msiexec.exe Token: SeSecurityPrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeLoadDriverPrivilege 1900 msiexec.exe Token: SeSystemProfilePrivilege 1900 msiexec.exe Token: SeSystemtimePrivilege 1900 msiexec.exe Token: SeProfSingleProcessPrivilege 1900 msiexec.exe Token: SeIncBasePriorityPrivilege 1900 msiexec.exe Token: SeCreatePagefilePrivilege 1900 msiexec.exe Token: SeCreatePermanentPrivilege 1900 msiexec.exe Token: SeBackupPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeShutdownPrivilege 1900 msiexec.exe Token: SeDebugPrivilege 1900 msiexec.exe Token: SeAuditPrivilege 1900 msiexec.exe Token: SeSystemEnvironmentPrivilege 1900 msiexec.exe Token: SeChangeNotifyPrivilege 1900 msiexec.exe Token: SeRemoteShutdownPrivilege 1900 msiexec.exe Token: SeUndockPrivilege 1900 msiexec.exe Token: SeSyncAgentPrivilege 1900 msiexec.exe Token: SeEnableDelegationPrivilege 1900 msiexec.exe Token: SeManageVolumePrivilege 1900 msiexec.exe Token: SeImpersonatePrivilege 1900 msiexec.exe Token: SeCreateGlobalPrivilege 1900 msiexec.exe Token: SeBackupPrivilege 2992 vssvc.exe Token: SeRestorePrivilege 2992 vssvc.exe Token: SeAuditPrivilege 2992 vssvc.exe Token: SeBackupPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeRestorePrivilege 2436 DrvInst.exe Token: SeRestorePrivilege 2436 DrvInst.exe Token: SeRestorePrivilege 2436 DrvInst.exe Token: SeRestorePrivilege 2436 DrvInst.exe Token: SeRestorePrivilege 2436 DrvInst.exe Token: SeRestorePrivilege 2436 DrvInst.exe Token: SeRestorePrivilege 2436 DrvInst.exe Token: SeLoadDriverPrivilege 2436 DrvInst.exe Token: SeLoadDriverPrivilege 2436 DrvInst.exe Token: SeLoadDriverPrivilege 2436 DrvInst.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe Token: SeRestorePrivilege 1656 msiexec.exe Token: SeTakeOwnershipPrivilege 1656 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1900 msiexec.exe 1900 msiexec.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2276 1656 msiexec.exe 32 PID 1656 wrote to memory of 2276 1656 msiexec.exe 32 PID 1656 wrote to memory of 2276 1656 msiexec.exe 32 PID 1656 wrote to memory of 2276 1656 msiexec.exe 32 PID 1656 wrote to memory of 2276 1656 msiexec.exe 32 PID 1656 wrote to memory of 2276 1656 msiexec.exe 32 PID 1656 wrote to memory of 2276 1656 msiexec.exe 32 PID 2276 wrote to memory of 2156 2276 MsiExec.exe 33 PID 2276 wrote to memory of 2156 2276 MsiExec.exe 33 PID 2276 wrote to memory of 2156 2276 MsiExec.exe 33 PID 2276 wrote to memory of 2156 2276 MsiExec.exe 33 PID 2276 wrote to memory of 1556 2276 MsiExec.exe 35 PID 2276 wrote to memory of 1556 2276 MsiExec.exe 35 PID 2276 wrote to memory of 1556 2276 MsiExec.exe 35 PID 2276 wrote to memory of 1556 2276 MsiExec.exe 35 PID 2276 wrote to memory of 2028 2276 MsiExec.exe 37 PID 2276 wrote to memory of 2028 2276 MsiExec.exe 37 PID 2276 wrote to memory of 2028 2276 MsiExec.exe 37 PID 2276 wrote to memory of 2028 2276 MsiExec.exe 37 PID 2276 wrote to memory of 2756 2276 MsiExec.exe 38 PID 2276 wrote to memory of 2756 2276 MsiExec.exe 38 PID 2276 wrote to memory of 2756 2276 MsiExec.exe 38 PID 2276 wrote to memory of 2756 2276 MsiExec.exe 38 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1900
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E99F151B9124F5A054C7C9A8D98E746E2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-57eb3fc1-f3ae-4cc1-9278-a33a0100b826\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2156
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\MW-57eb3fc1-f3ae-4cc1-9278-a33a0100b826\files\Autoit3.exe"C:\Users\Admin\AppData\Local\Temp\MW-57eb3fc1-f3ae-4cc1-9278-a33a0100b826\files\Autoit3.exe" UGtZgHHT.au33⤵
- Executes dropped EXE
PID:2028
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-57eb3fc1-f3ae-4cc1-9278-a33a0100b826\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:2756
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002C8" "000000000000040C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5e7c3b16ed93b760546ae6756b12644da
SHA199b3b1af70b45b4b815a814f61f9b6e509cd3bb6
SHA256659733a584c52078ac6b568dfb34a089bef2b3835a5ea737d32c1623a468b743
SHA512b6eeaaeeb1f7c8335076075bc8033d5d4744544f3937eeaddcbef5f7ba257a64c20a47f8388c1e8f10c5821da8abe0683be8fd60c3e1a9aea25e4a705e2f8b41
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
757KB
MD51b524d03b27b94906c1a87b207e08179
SHA18fbad6275708a69b764992b05126e053134fb9e9
SHA2561af981d9c5128b3657cdb5506d61563e0d1908b957e5dd6842059d6d3cfdc622
SHA5121e0f2aea5daa40b6cb7df61ba86e0956356ab7b7ecfc9e2934bc85eec8d42d3aeb32858dd0ead24e82ef261a4120f6374263b7af9256eb79a294d51273cc4f6e
-
Filesize
1KB
MD5873097cd22f820503a8424a415c51a98
SHA166059e90a68430f74713f174cbf63aeee1f0e5b9
SHA25680ec5006b27ff2c922f1d3c274a94fcd0aac6c2d2b963357a40ad9d811d43a6e
SHA512cfdb9d3b9cd13313db90e5cfdaf8707519c6c1098d06e031be436af67dc099e8e2a672ce162097767f8e79f664342183fb3c4db68b944292c1b6428f5ca8985f
-
Filesize
1KB
MD51b64c495026aae52e84f9270d1b7114a
SHA1740572d2b2d210842abcc5626e54ce05272df546
SHA2564a1dc7a42227623deaf682c163a607b804c33aa028453a887a0b89a2e467a91c
SHA5129406ca0af0060ab925e2c56e8cd290e7c88ee306ff0e4526acf8b1e15e404ef5182914acfe4ea2a3c5a4a352f7dae0527b67e866d8ff0857e9c993cecf3b7013
-
Filesize
1KB
MD55073956aef1889928a5bb5a53324d63f
SHA1e4539b383555d46b4d6c3bd1d0595299678020e4
SHA2569692acd8a99a26e801df77648da58cf30a9d7cf4a92455c32eccfaac2aed7067
SHA512fa4ea8da15759331ee8b64ff57e440e01f7d80cf390179e8c44d451fcfc08c9f5a38ac0adc55ba9bda206a45741491ca661bedd0400a5ca9eaf5640d8c26c1c7
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b