Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 18:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Tax_Document/IVIEWERS.dll
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax_Document/IVIEWERS.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
Tax_Document/Tax_Document.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
Tax_Document/IVIEWERS.dll
-
Size
2.4MB
-
MD5
cd8fff708a1a99a4d3b5bfec49ae278a
-
SHA1
367050b2323952b52a11fcb55dd359e59637a884
-
SHA256
cbf2ceb3c5ebc6f1d8c09f3098176ded9503800cba77cfefa25ea9e0a8085ae3
-
SHA512
80485ca1ee306b2f9e6b18d747bfc148c3f69f98f58ade8d675babbabff20e4d387a3bb83e1ab05aff166a29df4eefeed8df989d2c8af339e68b4d365064eb68
-
SSDEEP
49152:fLRISHEkoozx3u4+iTjaipEluOhYBUvqQENPvGzf:fLRZzx3nql1UUSQENPvE
Malware Config
Extracted
Family
darkgate
Botnet
seal1
C2
193.142.146.203
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
AVUHIwtf
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
false
-
username
seal1
Signatures
-
Detect DarkGate stealer 8 IoCs
resource yara_rule behavioral2/memory/312-3-0x0000000010000000-0x0000000010281000-memory.dmp family_darkgate_v6 behavioral2/memory/312-5-0x0000000010000000-0x0000000010281000-memory.dmp family_darkgate_v6 behavioral2/memory/544-7-0x00000000012D0000-0x0000000001342000-memory.dmp family_darkgate_v6 behavioral2/memory/544-8-0x00000000012D0000-0x0000000001342000-memory.dmp family_darkgate_v6 behavioral2/memory/544-9-0x00000000012D0000-0x0000000001342000-memory.dmp family_darkgate_v6 behavioral2/memory/544-12-0x00000000012D0000-0x0000000001342000-memory.dmp family_darkgate_v6 behavioral2/memory/544-11-0x00000000012D0000-0x0000000001342000-memory.dmp family_darkgate_v6 behavioral2/memory/544-14-0x00000000012D0000-0x0000000001342000-memory.dmp family_darkgate_v6 -
Blocklisted process makes network request 64 IoCs
flow pid Process 18 544 rundll32.exe 19 544 rundll32.exe 20 544 rundll32.exe 21 544 rundll32.exe 22 544 rundll32.exe 29 544 rundll32.exe 34 544 rundll32.exe 38 544 rundll32.exe 39 544 rundll32.exe 40 544 rundll32.exe 41 544 rundll32.exe 42 544 rundll32.exe 43 544 rundll32.exe 44 544 rundll32.exe 45 544 rundll32.exe 46 544 rundll32.exe 47 544 rundll32.exe 48 544 rundll32.exe 49 544 rundll32.exe 53 544 rundll32.exe 54 544 rundll32.exe 55 544 rundll32.exe 56 544 rundll32.exe 57 544 rundll32.exe 58 544 rundll32.exe 59 544 rundll32.exe 60 544 rundll32.exe 63 544 rundll32.exe 66 544 rundll32.exe 67 544 rundll32.exe 68 544 rundll32.exe 69 544 rundll32.exe 70 544 rundll32.exe 71 544 rundll32.exe 72 544 rundll32.exe 73 544 rundll32.exe 74 544 rundll32.exe 76 544 rundll32.exe 77 544 rundll32.exe 78 544 rundll32.exe 79 544 rundll32.exe 80 544 rundll32.exe 81 544 rundll32.exe 82 544 rundll32.exe 83 544 rundll32.exe 84 544 rundll32.exe 85 544 rundll32.exe 86 544 rundll32.exe 87 544 rundll32.exe 88 544 rundll32.exe 89 544 rundll32.exe 90 544 rundll32.exe 91 544 rundll32.exe 92 544 rundll32.exe 93 544 rundll32.exe 94 544 rundll32.exe 95 544 rundll32.exe 96 544 rundll32.exe 97 544 rundll32.exe 98 544 rundll32.exe 99 544 rundll32.exe 100 544 rundll32.exe 101 544 rundll32.exe 102 544 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 312 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 544 rundll32.exe 544 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 544 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3360 wrote to memory of 312 3360 rundll32.exe 84 PID 3360 wrote to memory of 312 3360 rundll32.exe 84 PID 3360 wrote to memory of 312 3360 rundll32.exe 84 PID 312 wrote to memory of 544 312 rundll32.exe 95 PID 312 wrote to memory of 544 312 rundll32.exe 95 PID 312 wrote to memory of 544 312 rundll32.exe 95 PID 312 wrote to memory of 544 312 rundll32.exe 95 PID 312 wrote to memory of 544 312 rundll32.exe 95 PID 312 wrote to memory of 544 312 rundll32.exe 95
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Tax_Document\IVIEWERS.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Tax_Document\IVIEWERS.dll,#12⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:544
-
-