Overview

overview

10

Static

static

3

Tax_Document.pdf.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-04-2024 19:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Tax_Document.pdf.exe

  • Size

    8.7MB

  • MD5

    04b527ca1b634ee5ed0cad4ab6ddd407

  • SHA1

    5f1bcd549190d3a34e8b574fe1820583c60f9caf

  • SHA256

    b54c8e984dbfed0bb80a5fdff2637a2e56a146f85a2712c29bef509d088ceb69

  • SHA512

    04fb6e32258bbe4a809da69d87dcac9fe3867402e7bab6b0a3fa6c42a46754665cf81d975a97c98c50b97aa870f164a48fec4eedc6a69214e6ff7a18b850b720

  • SSDEEP

    196608:dIgfnrpGKt1OEb0QtF+OCd6EWhKUzGZBvRadSP+fsjp8//k:dIgFGKtcEb0QtFf0WhKUzGZBvRadWy/k

Score
10/10
darkgateseal001persistencestealer

Malware Config

Extracted

Family

darkgate

Botnet

seal001

C2

185.196.220.194

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    QPNVenzK

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    false

  • username

    seal001

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate
  • Detect DarkGate stealer 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tax_Document.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Tax_Document.pdf.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\Tax_Document.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Tax_Document.pdf.exe"
      2⤵
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:228
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*SentinelOne" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\SentinelOne.dll",EntryPoint /f & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*SentinelOne" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\SentinelOne.dll",EntryPoint /f
        3⤵
        • Adds Run key to start application
        PID:3816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/228-3-0x0000000001090000-0x0000000001091000-memory.dmp

    Filesize

    4KB

    Download

  • memory/228-6-0x0000000001010000-0x0000000001083000-memory.dmp

    Filesize

    460KB

    Download

  • memory/228-7-0x0000000001010000-0x0000000001083000-memory.dmp

    Filesize

    460KB

    Download

  • memory/228-11-0x0000000001010000-0x0000000001083000-memory.dmp

    Filesize

    460KB

    Download

  • memory/228-12-0x0000000001010000-0x0000000001083000-memory.dmp

    Filesize

    460KB

    Download

  • memory/228-14-0x0000000001010000-0x0000000001083000-memory.dmp

    Filesize

    460KB

    Download

  • memory/228-16-0x0000000001010000-0x0000000001083000-memory.dmp

    Filesize

    460KB

    Download

  • memory/1640-0-0x0000000003250000-0x0000000003251000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1640-1-0x0000000010000000-0x0000000011A7F000-memory.dmp

    Filesize

    26.5MB

    Download

  • memory/1640-2-0x0000000000370000-0x0000000000C46000-memory.dmp

    Filesize

    8.8MB

    Download

  • memory/1640-9-0x0000000010000000-0x0000000011A7F000-memory.dmp

    Filesize

    26.5MB

    Download