Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
05/06/2024, 06:46
General
-
Target
2024-06-05_a928b42d86202e99058a1d2eec897451_darkgate_magniber.exe
-
Size
15.1MB
-
MD5
a928b42d86202e99058a1d2eec897451
-
SHA1
e15e42c173ffd18108bb7e55c151b58c4c28f9af
-
SHA256
0bb9def35e96ceaab2f5c480f67526c0d5efd8cd4ba0f7fbb0df374ac7e95d99
-
SHA512
d342a177b11c8e0af404e770bbee56ef0b491325831765407fb2c67527fcfdcdba06609f71bc0681cab939d558a5085d69e122690bed81c6d1fe35b3721eaf4c
-
SSDEEP
196608:GLJ80/s7A4zlBc5D18zZP2iIE80qLrHFLOyomFHKnPArxf5cBudLps7FLOyomFHE:Gq0k7AhD18BwE8zHFzxfKsNps7FoLL5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_a928b42d86202e99058a1d2eec897451_darkgate_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_a928b42d86202e99058a1d2eec897451_darkgate_magniber.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2024-06-05_a928b42d86202e99058a1d2eec897451_darkgate_magniber.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2024-06-05_a928b42d86202e99058a1d2eec897451_darkgate_magniber.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\LenovoQuickFix\QuickFix\LenovoSfcRepair\LenovoSfcRepair.exe"C:\LenovoQuickFix\QuickFix\LenovoSfcRepair\LenovoSfcRepair.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5f827eb21db930c1dffc5446bbd90641f
SHA1b05b9bf04f78374681f02277751d5dbd7756da65
SHA256f8a21f9098ac485e2b014d05a9d85bf080b44c946e918cc285ed358409e4a527
SHA51242cd674abcafe0fecd22b6b7f9fd60ed9c3a189715742be8dcdf9e04bc07a0f6e764945352a09627af70a901fd636e73a5b3cb6e689f3fcb8e4bb7eb1444ac57
-
Filesize
33KB
MD5cb15bbd4cc743f803bb133bc51d53757
SHA12872286db08a2bed0805471fb1d6b570f457f486
SHA2566c58c7718f09d0dd7d585c60cfd6d91935cc9cfdffb05f2c98b308b84aa5e921
SHA512f2ff9fa45e58449ecf462c325f8c6fe28ff3eb65f15f6e421dcf29ccdeaf6a2b64bfe80e3d206870fba61214bc72beab0b02039ddfe3a2433ad86c119888c4fb
-
Filesize
1.4MB
MD5b08673fc93518027199a5b7ccff2a222
SHA17c9e03a1eaaa35057f00386b6c31c2035cdbb916
SHA25650cd1b4b05b4908298e7111c25a8c902eff2f64fe8ed8655269b0af89f917bf3
SHA51255989b895125db8a68dab1bca35230dae66ce7c1e9c846e978ad4fee50382423aff7b9bc827c6ed69e0182a9b465ab94ddd0e7bac5c855b453cfe9225d4486e7
-
Filesize
760KB
MD5bfa401e3618a7bf14ea2f6199edfe113
SHA143acebc12e035dbf4290b3139baa8a1aed3fac47
SHA256e083d9d267256d0c31741fd3494138fb80296561fe20e51b91d8898277754ccd
SHA5129c85b45d215eafad1e238751814d573c98368111523e0f9608da93b72a170c183e5b8fde92268853b3e9562f3a92bf92323f4b7e99ff00afc426cfaf432571f4
-
Filesize
4.2MB
MD5de6eff382af93fd09b54cea3a5e4e1f0
SHA1fd8d5ba9387c19223761aae5543f456095f7f75b
SHA25686bbfd859d3db03686d080c6f220ca238b3774c3bfcd27bfcdd14421779edc13
SHA5126e9887d531d06ee8edf23955ebb2aaa3273d171001a2264a958bc9aea66ef659af9e6112382b81f859b1953153af5800379f072228195444812222af0f1a68a0
-
Filesize
419KB
MD5e28d4fba1dce207f9a8c9216b5104ec4
SHA1513d5a2426cf31cc8f9a4d1be3a9021be0d18ede
SHA256da1100a8cbd154d4302c73e334c7a5e9810ec1f70d8ddee33d10cf91ec09a261
SHA512796390b0422d75d7168c0a718a0db926797cac2297b929abf62bc594b94d6e9034ee71b6784b848a521b1ff3145f8a1ba4db1a32c8ae41f3736b529942fae828
-
Filesize
15.1MB
MD5a928b42d86202e99058a1d2eec897451
SHA1e15e42c173ffd18108bb7e55c151b58c4c28f9af
SHA2560bb9def35e96ceaab2f5c480f67526c0d5efd8cd4ba0f7fbb0df374ac7e95d99
SHA512d342a177b11c8e0af404e770bbee56ef0b491325831765407fb2c67527fcfdcdba06609f71bc0681cab939d558a5085d69e122690bed81c6d1fe35b3721eaf4c
-
Filesize
14.4MB
MD555505bc96aada5617269917a7d471eed
SHA1b6d2bbb99824f5cdf7abf3e06c8224cda299d42a
SHA256a883c34f3a26284aecd0357df9aef18268537ce6a4c77f8918ee812902d3a451
SHA512ee9b734fb7a999f9880a7606b11c4294c3bd1b1161ca152fcb0cbc74f7f503b9793f291ae92d72875363ea87538cd308e265bdc78bd7df7065ab7b36702174c2
-
Filesize
15.2MB
-
Filesize
4KB
-
Filesize
15.2MB
-
Filesize
15.2MB
-
Filesize
15.2MB