Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
Tax_Document_23/IVIEWERS.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
Tax_Document_23/IVIEWERS.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Tax_Document_23/Tax_Document.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Tax_Document_23/Tax_Document.exe
Resource
win10v2004-20240226-en
General
-
Target
Tax_Document_23/Tax_Document.exe
-
Size
186KB
-
MD5
df33c821c06835a1349cbe3b0c65f24c
-
SHA1
5ddbb84801115d8e495b14c3963f6b174b5801f2
-
SHA256
0263663c5375289fa2550d0cff3553dfc160a767e718a9c38efc0da3d7a4b626
-
SHA512
13a9eff075b12b6ef398e103eda806ceed737665d35955c8882defd63ef0c9e25ecfe856ebf5560cbb61a02821ddcf9993290138fa8cdb0150ebbe0b7a1e6195
-
SSDEEP
3072:IUiDZK+VBulx0QtCggULGWtf5Ju+uaxObQPEoSlpcm8Cy/V:wZjz2NqWtfHduaxOEPJAcmgV
Malware Config
Extracted
darkgate
seal1
193.142.146.203
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
AVUHIwtf
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
false
-
username
seal1
Signatures
-
Detect DarkGate stealer 8 IoCs
resource yara_rule behavioral4/memory/4188-2-0x0000000010000000-0x0000000010242000-memory.dmp family_darkgate_v6 behavioral4/memory/4188-4-0x0000000010000000-0x0000000010242000-memory.dmp family_darkgate_v6 behavioral4/memory/4164-6-0x0000000000E60000-0x0000000000ED2000-memory.dmp family_darkgate_v6 behavioral4/memory/4164-8-0x0000000000E60000-0x0000000000ED2000-memory.dmp family_darkgate_v6 behavioral4/memory/4164-7-0x0000000000E60000-0x0000000000ED2000-memory.dmp family_darkgate_v6 behavioral4/memory/4164-11-0x0000000000E60000-0x0000000000ED2000-memory.dmp family_darkgate_v6 behavioral4/memory/4164-12-0x0000000000E60000-0x0000000000ED2000-memory.dmp family_darkgate_v6 behavioral4/memory/4164-14-0x0000000000E60000-0x0000000000ED2000-memory.dmp family_darkgate_v6 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*Chrome = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\VIVA_01.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4188 Tax_Document.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Tax_Document.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Tax_Document.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4164 Tax_Document.exe 4164 Tax_Document.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4164 Tax_Document.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4188 Tax_Document.exe 4188 Tax_Document.exe 4188 Tax_Document.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4188 wrote to memory of 1280 4188 Tax_Document.exe 96 PID 4188 wrote to memory of 1280 4188 Tax_Document.exe 96 PID 4188 wrote to memory of 1280 4188 Tax_Document.exe 96 PID 4188 wrote to memory of 4164 4188 Tax_Document.exe 97 PID 4188 wrote to memory of 4164 4188 Tax_Document.exe 97 PID 4188 wrote to memory of 4164 4188 Tax_Document.exe 97 PID 4188 wrote to memory of 4164 4188 Tax_Document.exe 97 PID 4188 wrote to memory of 4164 4188 Tax_Document.exe 97 PID 4188 wrote to memory of 4164 4188 Tax_Document.exe 97 PID 1280 wrote to memory of 4516 1280 cmd.exe 99 PID 1280 wrote to memory of 4516 1280 cmd.exe 99 PID 1280 wrote to memory of 4516 1280 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax_Document_23\Tax_Document.exe"C:\Users\Admin\AppData\Local\Temp\Tax_Document_23\Tax_Document.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\VIVA_01.dll",EntryPoint /f & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\VIVA_01.dll",EntryPoint /f3⤵
- Adds Run key to start application
PID:4516
-
-
-
C:\Users\Admin\AppData\Local\Temp\Tax_Document_23\Tax_Document.exe"C:\Users\Admin\AppData\Local\Temp\Tax_Document_23\Tax_Document.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4164
-