Analysis
-
max time kernel
453s -
max time network
458s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 05:17
Static task
static1
Behavioral task
behavioral1
Sample
New folder/execute.bat
Resource
win7-20240508-en
windows7-x64
11 signatures
600 seconds
General
-
Target
New folder/execute.bat
-
Size
29B
-
MD5
9cb80398908d1720da4a0ff9052280ab
-
SHA1
ec13380c5a107ad18b08c546fc067f3ccd8fecfc
-
SHA256
ecbdb7843d10d746282f0eddf1dc89ab7927e19102492711be4dc1b26ace13f1
-
SHA512
29da0caa5142654408b34a9e2685030ff06bafc74c3ef413868954bbf29464d228079a3227db0bc4f1d666ef4fa22b62135d01b96bf98a17a8a7a9edaf8e3ab2
Malware Config
Extracted
Family
darkgate
Botnet
admin888
C2
kindupdates.com
Attributes
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
VjpTnzOY
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
-
Detect DarkGate stealer 2 IoCs
resource yara_rule behavioral2/memory/2676-3-0x0000000004500000-0x000000000489A000-memory.dmp family_darkgate_v6 behavioral2/memory/2676-4-0x0000000004500000-0x000000000489A000-memory.dmp family_darkgate_v6 -
Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
pid Process 2676 Autoit3.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2676 Autoit3.exe 2676 Autoit3.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4944 taskmgr.exe Token: SeSystemProfilePrivilege 4944 taskmgr.exe Token: SeCreateGlobalPrivilege 4944 taskmgr.exe Token: SeSecurityPrivilege 4944 taskmgr.exe Token: SeTakeOwnershipPrivilege 4944 taskmgr.exe Token: 33 4944 taskmgr.exe Token: SeIncBasePriorityPrivilege 4944 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3564 wrote to memory of 3396 3564 cmd.exe 85 PID 3564 wrote to memory of 3396 3564 cmd.exe 85 PID 3396 wrote to memory of 2676 3396 cmd.exe 86 PID 3396 wrote to memory of 2676 3396 cmd.exe 86 PID 3396 wrote to memory of 2676 3396 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\New folder\execute.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\system32\cmd.execmd /c autoit3.exe script.a3x2⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\New folder\Autoit3.exeautoit3.exe script.a3x3⤵
- Command and Scripting Interpreter: AutoIT
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2676
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4944