Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 13:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IVIEWERS.dll
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
IVIEWERS.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
TAX Organizer.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
IVIEWERS.dll
-
Size
2.5MB
-
MD5
2c05d969633cb477ad7d4e4f4d47f632
-
SHA1
653838a5a15acadb049b0bfc0fd4b80557eddcc8
-
SHA256
ee49fc6117342373f3f5ddff5db3e39ea69d45b1f2b1b848815e3355073d0571
-
SHA512
9b1c9bb9e5949362bddb63296e01a834eb7dce69e4a1fdb735b2cdda09b8f33c72f0561925601ad7df02eb9adee874e8f910e87ba449a4ca0c591b1930202602
-
SSDEEP
49152:h566l2u45aAHNYFrz31Cv3D29kd6kjBD+7OcP0hB:h566l2u45aAHNYFrkvz29kdJjdTcPk
Malware Config
Extracted
Family
darkgate
Botnet
tompang
C2
78.142.18.222
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
ClUqWMEv
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
false
-
username
tompang
Signatures
-
Detect DarkGate stealer 8 IoCs
resource yara_rule behavioral2/memory/4472-3-0x0000000010000000-0x000000001029F000-memory.dmp family_darkgate_v6 behavioral2/memory/4472-5-0x0000000010000000-0x000000001029F000-memory.dmp family_darkgate_v6 behavioral2/memory/5048-6-0x0000000000D20000-0x0000000000D92000-memory.dmp family_darkgate_v6 behavioral2/memory/5048-7-0x0000000000D20000-0x0000000000D92000-memory.dmp family_darkgate_v6 behavioral2/memory/5048-9-0x0000000000D20000-0x0000000000D92000-memory.dmp family_darkgate_v6 behavioral2/memory/5048-11-0x0000000000D20000-0x0000000000D92000-memory.dmp family_darkgate_v6 behavioral2/memory/5048-12-0x0000000000D20000-0x0000000000D92000-memory.dmp family_darkgate_v6 behavioral2/memory/5048-14-0x0000000000D20000-0x0000000000D92000-memory.dmp family_darkgate_v6 -
Blocklisted process makes network request 64 IoCs
flow pid Process 61 5048 rundll32.exe 63 5048 rundll32.exe 68 5048 rundll32.exe 70 5048 rundll32.exe 73 5048 rundll32.exe 74 5048 rundll32.exe 75 5048 rundll32.exe 76 5048 rundll32.exe 77 5048 rundll32.exe 80 5048 rundll32.exe 81 5048 rundll32.exe 82 5048 rundll32.exe 83 5048 rundll32.exe 84 5048 rundll32.exe 86 5048 rundll32.exe 87 5048 rundll32.exe 91 5048 rundll32.exe 95 5048 rundll32.exe 97 5048 rundll32.exe 101 5048 rundll32.exe 102 5048 rundll32.exe 103 5048 rundll32.exe 107 5048 rundll32.exe 110 5048 rundll32.exe 111 5048 rundll32.exe 112 5048 rundll32.exe 113 5048 rundll32.exe 114 5048 rundll32.exe 115 5048 rundll32.exe 116 5048 rundll32.exe 117 5048 rundll32.exe 118 5048 rundll32.exe 119 5048 rundll32.exe 120 5048 rundll32.exe 121 5048 rundll32.exe 122 5048 rundll32.exe 123 5048 rundll32.exe 124 5048 rundll32.exe 125 5048 rundll32.exe 126 5048 rundll32.exe 127 5048 rundll32.exe 128 5048 rundll32.exe 129 5048 rundll32.exe 130 5048 rundll32.exe 131 5048 rundll32.exe 132 5048 rundll32.exe 134 5048 rundll32.exe 135 5048 rundll32.exe 136 5048 rundll32.exe 137 5048 rundll32.exe 143 5048 rundll32.exe 144 5048 rundll32.exe 145 5048 rundll32.exe 147 5048 rundll32.exe 148 5048 rundll32.exe 149 5048 rundll32.exe 150 5048 rundll32.exe 152 5048 rundll32.exe 153 5048 rundll32.exe 154 5048 rundll32.exe 155 5048 rundll32.exe 156 5048 rundll32.exe 157 5048 rundll32.exe 158 5048 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4472 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5048 rundll32.exe 5048 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5048 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 208 wrote to memory of 4472 208 rundll32.exe 89 PID 208 wrote to memory of 4472 208 rundll32.exe 89 PID 208 wrote to memory of 4472 208 rundll32.exe 89 PID 4472 wrote to memory of 5048 4472 rundll32.exe 102 PID 4472 wrote to memory of 5048 4472 rundll32.exe 102 PID 4472 wrote to memory of 5048 4472 rundll32.exe 102 PID 4472 wrote to memory of 5048 4472 rundll32.exe 102 PID 4472 wrote to memory of 5048 4472 rundll32.exe 102 PID 4472 wrote to memory of 5048 4472 rundll32.exe 102
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IVIEWERS.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\IVIEWERS.dll,#12⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5048
-
-