Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03-04-2024 14:35
Static task
static1
Behavioral task
behavioral1
Sample
IVIEWERS.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
IVIEWERS.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Tax_Document.exe
Resource
win7-20240221-en
General
-
Target
IVIEWERS.dll
-
Size
2.4MB
-
MD5
cd8fff708a1a99a4d3b5bfec49ae278a
-
SHA1
367050b2323952b52a11fcb55dd359e59637a884
-
SHA256
cbf2ceb3c5ebc6f1d8c09f3098176ded9503800cba77cfefa25ea9e0a8085ae3
-
SHA512
80485ca1ee306b2f9e6b18d747bfc148c3f69f98f58ade8d675babbabff20e4d387a3bb83e1ab05aff166a29df4eefeed8df989d2c8af339e68b4d365064eb68
-
SSDEEP
49152:fLRISHEkoozx3u4+iTjaipEluOhYBUvqQENPvGzf:fLRZzx3nql1UUSQENPvE
Malware Config
Extracted
darkgate
seal1
193.142.146.203
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
AVUHIwtf
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
false
-
username
seal1
Signatures
-
Detect DarkGate stealer 11 IoCs
resource yara_rule behavioral1/memory/2748-11-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/2168-10-0x0000000010000000-0x0000000010281000-memory.dmp family_darkgate_v6 behavioral1/memory/2748-14-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/2748-16-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/2748-12-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/2748-18-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/2748-19-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/2748-20-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/2748-21-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/2168-22-0x0000000010000000-0x0000000010281000-memory.dmp family_darkgate_v6 behavioral1/memory/2748-23-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 -
Blocklisted process makes network request 64 IoCs
flow pid Process 2 2748 rundll32.exe 3 2748 rundll32.exe 4 2748 rundll32.exe 5 2748 rundll32.exe 6 2748 rundll32.exe 7 2748 rundll32.exe 8 2748 rundll32.exe 9 2748 rundll32.exe 10 2748 rundll32.exe 11 2748 rundll32.exe 12 2748 rundll32.exe 13 2748 rundll32.exe 14 2748 rundll32.exe 15 2748 rundll32.exe 16 2748 rundll32.exe 17 2748 rundll32.exe 18 2748 rundll32.exe 19 2748 rundll32.exe 20 2748 rundll32.exe 21 2748 rundll32.exe 22 2748 rundll32.exe 23 2748 rundll32.exe 24 2748 rundll32.exe 25 2748 rundll32.exe 26 2748 rundll32.exe 27 2748 rundll32.exe 28 2748 rundll32.exe 29 2748 rundll32.exe 30 2748 rundll32.exe 31 2748 rundll32.exe 32 2748 rundll32.exe 33 2748 rundll32.exe 34 2748 rundll32.exe 35 2748 rundll32.exe 36 2748 rundll32.exe 37 2748 rundll32.exe 38 2748 rundll32.exe 39 2748 rundll32.exe 40 2748 rundll32.exe 41 2748 rundll32.exe 42 2748 rundll32.exe 43 2748 rundll32.exe 44 2748 rundll32.exe 45 2748 rundll32.exe 46 2748 rundll32.exe 47 2748 rundll32.exe 48 2748 rundll32.exe 49 2748 rundll32.exe 50 2748 rundll32.exe 51 2748 rundll32.exe 52 2748 rundll32.exe 53 2748 rundll32.exe 54 2748 rundll32.exe 55 2748 rundll32.exe 56 2748 rundll32.exe 57 2748 rundll32.exe 58 2748 rundll32.exe 59 2748 rundll32.exe 60 2748 rundll32.exe 61 2748 rundll32.exe 62 2748 rundll32.exe 63 2748 rundll32.exe 64 2748 rundll32.exe 65 2748 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2168 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2748 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2748 rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2168 2320 rundll32.exe 28 PID 2320 wrote to memory of 2168 2320 rundll32.exe 28 PID 2320 wrote to memory of 2168 2320 rundll32.exe 28 PID 2320 wrote to memory of 2168 2320 rundll32.exe 28 PID 2320 wrote to memory of 2168 2320 rundll32.exe 28 PID 2320 wrote to memory of 2168 2320 rundll32.exe 28 PID 2320 wrote to memory of 2168 2320 rundll32.exe 28 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29 PID 2168 wrote to memory of 2748 2168 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IVIEWERS.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IVIEWERS.dll,#12⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2748
-
-