Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 00:26
General
-
Target
2024-05-23_19e407b6fe29797017c45ab33c80de0b_darkgate_magniber.exe
-
Size
6.4MB
-
MD5
19e407b6fe29797017c45ab33c80de0b
-
SHA1
668a39cf3db3aa8fdb5d95481506de888c0ebbde
-
SHA256
4ba6d134d0b56c39622ff5978f1582d1707d809090b46020c1a3ad489a102282
-
SHA512
be6bf3f757e8dcd92a30d325221c9f15f467637f735c3842a22b8de302b31bcbae4524fe07ce9aa4a34883926c2fc77c659b619f11c95bfdd28a07b91cbebbf1
-
SSDEEP
196608:GLnrxUCGSTOuajel1vEEBhyc7EYrTouj0k:GRaiD84ycxLj0k
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_19e407b6fe29797017c45ab33c80de0b_darkgate_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_19e407b6fe29797017c45ab33c80de0b_darkgate_magniber.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2024-05-23_19e407b6fe29797017c45ab33c80de0b_darkgate_magniber.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2024-05-23_19e407b6fe29797017c45ab33c80de0b_darkgate_magniber.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{07931542-8919-4B90-BAC7-F682E1EF3EE9}\DIAS Installer Module.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="._cache_2024-05-23_19e407b6fe29797017c45ab33c80de0b_darkgate_magniber.exe"3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DC3666F58EF8472069E85B5F9957A581 C2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
6.4MB
MD519e407b6fe29797017c45ab33c80de0b
SHA1668a39cf3db3aa8fdb5d95481506de888c0ebbde
SHA2564ba6d134d0b56c39622ff5978f1582d1707d809090b46020c1a3ad489a102282
SHA512be6bf3f757e8dcd92a30d325221c9f15f467637f735c3842a22b8de302b31bcbae4524fe07ce9aa4a34883926c2fc77c659b619f11c95bfdd28a07b91cbebbf1
-
C:\Users\Admin\AppData\Local\Temp\._cache_2024-05-23_19e407b6fe29797017c45ab33c80de0b_darkgate_magniber.exeFilesize
5.7MB
MD5953078f0242c7028b50c96a62989e331
SHA16f5805dc5eb0c35c8d34f05862c5f01ed21f68e1
SHA256484595fbbdb007fbb2bd16e609ba1c1371fd9749c1c8bb6b40a7f257fdb67c3d
SHA5129cdb2cd87b7505f6482cd0c47e886864300392634f45f310342af32a042f79412c31560e4f9fca469bc5e7ec0b4c99ca682833df85fd9d1bded2c90164f44bf3
-
C:\Users\Admin\AppData\Local\Temp\MSI783D.tmpFilesize
210KB
MD5d0e93d8f24c62d3d419ff831d2141f60
SHA16115cab23ff1423d6920a75a19b76434d3f1ab0b
SHA25661e63c049d6dd933703b53603cbc4437583483aa586c802c91f57cbc4453f5ac
SHA5129300e22640406d83e6864d89d17c0e7944898e16add6faa77ec7ce8803fcee3e9859599440cd77c7010d143ca1bb6eb29d194c05f751d7e1c3632bbb7e2673bd
-
C:\Users\Admin\AppData\Local\Temp\{07931542-8919-4B90-BAC7-F682E1EF3EE9}\0x0409.iniFilesize
21KB
MD5be345d0260ae12c5f2f337b17e07c217
SHA10976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA256e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
SHA51277040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
-
C:\Users\Admin\AppData\Local\Temp\{07931542-8919-4B90-BAC7-F682E1EF3EE9}\DIAS Installer Module.msiFilesize
2.4MB
MD56d79149cc3f1f111d9c7b669d19251aa
SHA1fa78d2799a7de687951edd3b5ac8e1995f3b0929
SHA2563e6a00678821ecda14e7f791c27daf27b89007493cabba9264cda50487bc34df
SHA5121fc5c71aca969f6599f9461d679cc11108444f107d18bbc3942ede356632230574d14ea86f62ff98e300f3023382027ed22bd8d27507e6361c12b38c357b1d8f
-
C:\Users\Admin\AppData\Local\Temp\{B73B5E3D-2B2D-4CB5-A0A5-EF431F7C3B9B}\_ISMSIDEL.INIFilesize
20B
MD5db9af7503f195df96593ac42d5519075
SHA11b487531bad10f77750b8a50aca48593379e5f56
SHA2560a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA5126839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
-
C:\Users\Admin\AppData\Local\Temp\~60FC.tmpFilesize
5KB
MD55ebba1745981b75348ab33ef1fd77ee5
SHA1f457a3da8349c112509fca2b16e988679fad66ec
SHA256ed28f5e3ccd6e3f06705f8b74e639ed79a1d14275405d4222faf028cd140af5e
SHA5126ab41dce132159edfef0013059e9347e1d64946615ac82f0a760b1935396a13dcfae557ef3c65033ee22fb00bc3e79c73758fa7a74e9b668a1c366ac6721e7b9
-
memory/1220-0-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/1220-123-0x0000000000400000-0x0000000000A6F000-memory.dmpFilesize
6.4MB
-
memory/2848-216-0x0000000000400000-0x0000000000A6F000-memory.dmpFilesize
6.4MB
-
memory/2848-239-0x0000000000400000-0x0000000000A6F000-memory.dmpFilesize
6.4MB
-
memory/2848-259-0x0000000000400000-0x0000000000A6F000-memory.dmpFilesize
6.4MB