Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IVIEWERS.dll
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
IVIEWERS.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
Tax_Document.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
IVIEWERS.dll
-
Size
2.4MB
-
MD5
cd8fff708a1a99a4d3b5bfec49ae278a
-
SHA1
367050b2323952b52a11fcb55dd359e59637a884
-
SHA256
cbf2ceb3c5ebc6f1d8c09f3098176ded9503800cba77cfefa25ea9e0a8085ae3
-
SHA512
80485ca1ee306b2f9e6b18d747bfc148c3f69f98f58ade8d675babbabff20e4d387a3bb83e1ab05aff166a29df4eefeed8df989d2c8af339e68b4d365064eb68
-
SSDEEP
49152:fLRISHEkoozx3u4+iTjaipEluOhYBUvqQENPvGzf:fLRZzx3nql1UUSQENPvE
Malware Config
Extracted
Family
darkgate
Botnet
seal1
C2
193.142.146.203
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
AVUHIwtf
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
false
-
username
seal1
Signatures
-
Detect DarkGate stealer 7 IoCs
resource yara_rule behavioral2/memory/1960-4-0x0000000010000000-0x0000000010281000-memory.dmp family_darkgate_v6 behavioral2/memory/1560-6-0x0000000001200000-0x0000000001272000-memory.dmp family_darkgate_v6 behavioral2/memory/1560-8-0x0000000001200000-0x0000000001272000-memory.dmp family_darkgate_v6 behavioral2/memory/1560-7-0x0000000001200000-0x0000000001272000-memory.dmp family_darkgate_v6 behavioral2/memory/1560-11-0x0000000001200000-0x0000000001272000-memory.dmp family_darkgate_v6 behavioral2/memory/1560-10-0x0000000001200000-0x0000000001272000-memory.dmp family_darkgate_v6 behavioral2/memory/1560-13-0x0000000001200000-0x0000000001272000-memory.dmp family_darkgate_v6 -
Blocklisted process makes network request 64 IoCs
flow pid Process 18 1560 rundll32.exe 19 1560 rundll32.exe 20 1560 rundll32.exe 22 1560 rundll32.exe 23 1560 rundll32.exe 26 1560 rundll32.exe 28 1560 rundll32.exe 30 1560 rundll32.exe 32 1560 rundll32.exe 34 1560 rundll32.exe 35 1560 rundll32.exe 36 1560 rundll32.exe 37 1560 rundll32.exe 40 1560 rundll32.exe 44 1560 rundll32.exe 46 1560 rundll32.exe 47 1560 rundll32.exe 48 1560 rundll32.exe 49 1560 rundll32.exe 50 1560 rundll32.exe 51 1560 rundll32.exe 52 1560 rundll32.exe 53 1560 rundll32.exe 54 1560 rundll32.exe 55 1560 rundll32.exe 56 1560 rundll32.exe 57 1560 rundll32.exe 58 1560 rundll32.exe 62 1560 rundll32.exe 68 1560 rundll32.exe 71 1560 rundll32.exe 74 1560 rundll32.exe 76 1560 rundll32.exe 77 1560 rundll32.exe 78 1560 rundll32.exe 79 1560 rundll32.exe 80 1560 rundll32.exe 81 1560 rundll32.exe 82 1560 rundll32.exe 83 1560 rundll32.exe 84 1560 rundll32.exe 85 1560 rundll32.exe 87 1560 rundll32.exe 90 1560 rundll32.exe 91 1560 rundll32.exe 93 1560 rundll32.exe 95 1560 rundll32.exe 96 1560 rundll32.exe 98 1560 rundll32.exe 99 1560 rundll32.exe 100 1560 rundll32.exe 101 1560 rundll32.exe 102 1560 rundll32.exe 103 1560 rundll32.exe 104 1560 rundll32.exe 105 1560 rundll32.exe 106 1560 rundll32.exe 107 1560 rundll32.exe 108 1560 rundll32.exe 109 1560 rundll32.exe 110 1560 rundll32.exe 111 1560 rundll32.exe 112 1560 rundll32.exe 115 1560 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1960 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1560 rundll32.exe 1560 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1560 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5068 wrote to memory of 1960 5068 rundll32.exe 85 PID 5068 wrote to memory of 1960 5068 rundll32.exe 85 PID 5068 wrote to memory of 1960 5068 rundll32.exe 85 PID 1960 wrote to memory of 1560 1960 rundll32.exe 90 PID 1960 wrote to memory of 1560 1960 rundll32.exe 90 PID 1960 wrote to memory of 1560 1960 rundll32.exe 90 PID 1960 wrote to memory of 1560 1960 rundll32.exe 90 PID 1960 wrote to memory of 1560 1960 rundll32.exe 90 PID 1960 wrote to memory of 1560 1960 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IVIEWERS.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IVIEWERS.dll,#12⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1560
-
-