Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 13:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IVIEWERS.dll
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
IVIEWERS.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
TAX Organizer.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
IVIEWERS.dll
-
Size
2.5MB
-
MD5
2c05d969633cb477ad7d4e4f4d47f632
-
SHA1
653838a5a15acadb049b0bfc0fd4b80557eddcc8
-
SHA256
ee49fc6117342373f3f5ddff5db3e39ea69d45b1f2b1b848815e3355073d0571
-
SHA512
9b1c9bb9e5949362bddb63296e01a834eb7dce69e4a1fdb735b2cdda09b8f33c72f0561925601ad7df02eb9adee874e8f910e87ba449a4ca0c591b1930202602
-
SSDEEP
49152:h566l2u45aAHNYFrz31Cv3D29kd6kjBD+7OcP0hB:h566l2u45aAHNYFrkvz29kdJjdTcPk
Malware Config
Extracted
Family
darkgate
Botnet
tompang
C2
78.142.18.222
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
ClUqWMEv
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
false
-
username
tompang
Signatures
-
Detect DarkGate stealer 10 IoCs
resource yara_rule behavioral1/memory/1784-3-0x0000000010000000-0x000000001029F000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-11-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-12-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-16-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-14-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-18-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-20-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-21-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-22-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 behavioral1/memory/1320-23-0x0000000000090000-0x0000000000102000-memory.dmp family_darkgate_v6 -
Blocklisted process makes network request 64 IoCs
flow pid Process 2 1320 rundll32.exe 3 1320 rundll32.exe 4 1320 rundll32.exe 5 1320 rundll32.exe 6 1320 rundll32.exe 7 1320 rundll32.exe 8 1320 rundll32.exe 9 1320 rundll32.exe 10 1320 rundll32.exe 11 1320 rundll32.exe 12 1320 rundll32.exe 13 1320 rundll32.exe 14 1320 rundll32.exe 15 1320 rundll32.exe 16 1320 rundll32.exe 17 1320 rundll32.exe 18 1320 rundll32.exe 19 1320 rundll32.exe 20 1320 rundll32.exe 21 1320 rundll32.exe 22 1320 rundll32.exe 23 1320 rundll32.exe 24 1320 rundll32.exe 25 1320 rundll32.exe 26 1320 rundll32.exe 27 1320 rundll32.exe 28 1320 rundll32.exe 29 1320 rundll32.exe 30 1320 rundll32.exe 31 1320 rundll32.exe 32 1320 rundll32.exe 33 1320 rundll32.exe 34 1320 rundll32.exe 35 1320 rundll32.exe 36 1320 rundll32.exe 37 1320 rundll32.exe 38 1320 rundll32.exe 39 1320 rundll32.exe 40 1320 rundll32.exe 41 1320 rundll32.exe 42 1320 rundll32.exe 43 1320 rundll32.exe 44 1320 rundll32.exe 45 1320 rundll32.exe 46 1320 rundll32.exe 47 1320 rundll32.exe 48 1320 rundll32.exe 49 1320 rundll32.exe 50 1320 rundll32.exe 51 1320 rundll32.exe 52 1320 rundll32.exe 53 1320 rundll32.exe 54 1320 rundll32.exe 55 1320 rundll32.exe 56 1320 rundll32.exe 57 1320 rundll32.exe 58 1320 rundll32.exe 59 1320 rundll32.exe 60 1320 rundll32.exe 61 1320 rundll32.exe 62 1320 rundll32.exe 63 1320 rundll32.exe 64 1320 rundll32.exe 65 1320 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1784 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1320 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1320 rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1784 1288 rundll32.exe 28 PID 1288 wrote to memory of 1784 1288 rundll32.exe 28 PID 1288 wrote to memory of 1784 1288 rundll32.exe 28 PID 1288 wrote to memory of 1784 1288 rundll32.exe 28 PID 1288 wrote to memory of 1784 1288 rundll32.exe 28 PID 1288 wrote to memory of 1784 1288 rundll32.exe 28 PID 1288 wrote to memory of 1784 1288 rundll32.exe 28 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29 PID 1784 wrote to memory of 1320 1784 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IVIEWERS.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IVIEWERS.dll,#12⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1320
-
-