Analysis

  • max time kernel
    55s
  • max time network
    66s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26-05-2024 23:49

Errors

Reason
Machine shutdown

General

  • Target

    DarkLoader.exe

  • Size

    53KB

  • MD5

    464f4201b6e847f3685e83503c8934af

  • SHA1

    7ce3d09cb4387a831c3073b251a70eb0771f1f17

  • SHA256

    37b738b858489999cad233e5527d50833cd7bd16b184eacc347670b98c76feff

  • SHA512

    d0681734e235b08d8d70b79cd1cac1da22196450f0e69f74749633542c559ee9f6ff85908202bd9a05ced0e1e62790a9fcb7e24802d288a58ceab39f2ed4a91f

  • SSDEEP

    768:5S7TZ38fvCv3E1cQrM+rMRa8Nu/itiHT:5uTZsHCv3Ear+gRJNU5

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Drops autorun.inf file 1 TTPs 5 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DarkLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\DarkLoader.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\DarkLoader.exe" "DarkLoader.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      PID:1832
    • C:\Users\Admin\AppData\Local\Temp\tmpF55C.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpF55C.tmp.exe"
      2⤵
      • Executes dropped EXE
      PID:652
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpF55C.tmp.exe

    Filesize

    2.5MB

    MD5

    5a9d19e4d434d2dbf8a87f2edcdef5f8

    SHA1

    df61cc0e7ec9afa82ea7de4b790336a623c555fa

    SHA256

    129ae20f2268060bde769a5c9d5530767b071402e153dff5268dd1ad349a310c

    SHA512

    cb377dc737e12b5655bfc47bacf75c2b406d28ec6e976f9857fa3cf2bf4c49ff7d96e8bc3b41b1e1d4b0d06891bd608bf4b2f6669c4e2c4a2bc4a8f2ea56c6ad

  • memory/652-31-0x00000207FC6A0000-0x00000207FC6AB000-memory.dmp

    Filesize

    44KB

  • memory/652-30-0x00000207FC680000-0x00000207FC69E000-memory.dmp

    Filesize

    120KB

  • memory/652-37-0x00007FFAC46D3000-0x00007FFAC46D5000-memory.dmp

    Filesize

    8KB

  • memory/652-27-0x00000207FC500000-0x00000207FC546000-memory.dmp

    Filesize

    280KB

  • memory/652-28-0x00000207FBC50000-0x00000207FBC59000-memory.dmp

    Filesize

    36KB

  • memory/652-24-0x00007FFAC46D3000-0x00007FFAC46D5000-memory.dmp

    Filesize

    8KB

  • memory/652-25-0x00000207F9D50000-0x00000207F9FC8000-memory.dmp

    Filesize

    2.5MB

  • memory/652-29-0x00000207FC670000-0x00000207FC67D000-memory.dmp

    Filesize

    52KB

  • memory/1568-1-0x00000000747C0000-0x0000000074D71000-memory.dmp

    Filesize

    5.7MB

  • memory/1568-0-0x00000000747C1000-0x00000000747C2000-memory.dmp

    Filesize

    4KB

  • memory/1568-26-0x00000000747C0000-0x0000000074D71000-memory.dmp

    Filesize

    5.7MB

  • memory/1568-2-0x00000000747C0000-0x0000000074D71000-memory.dmp

    Filesize

    5.7MB

  • memory/1568-12-0x00000000747C0000-0x0000000074D71000-memory.dmp

    Filesize

    5.7MB

  • memory/1568-11-0x00000000747C0000-0x0000000074D71000-memory.dmp

    Filesize

    5.7MB