Analysis
-
max time kernel
113s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 11:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
shellcode.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
300 seconds
General
-
Target
shellcode.exe
-
Size
146KB
-
MD5
c3003964fbad244db448b96c95d57319
-
SHA1
65026bbd3a65263e4da58c26e69c7576fd01d755
-
SHA256
e12c720480be024f98d3a5ebb31445e16373da9bd7933fe4b9fa9ccd940e9c1d
-
SHA512
7baf0bec4678184940d0a93c990aa6390b6ff379833706d62d51cd087284e1bc34ff047f9332baf7824fc14a0cc00830b9e815d09c9016b8edbb714d1b6a035c
-
SSDEEP
3072:pBy3MmqwKvAiu6p08+l1nBtHEcq3Wn2D8IX3lqrpyPM:ny3MxwKNmxrn0Wn2D8InlqrpkM
Malware Config
Extracted
Family
darkgate
Botnet
A1111
C2
http://wilsoncallert.com
Attributes
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
false
-
c2_port
2351
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
true
-
crypter_dll
false
-
crypter_raw_stub
false
-
crypto_key
nSoLLNAEzUGGah
-
internal_mutex
txtMut
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
A1111
Signatures
-
Detect DarkGate stealer 2 IoCs
resource yara_rule behavioral2/memory/536-2-0x00000000032F0000-0x00000000036B3000-memory.dmp family_darkgate_v6 behavioral2/memory/536-5-0x00000000032F0000-0x00000000036B3000-memory.dmp family_darkgate_v6 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 shellcode.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString shellcode.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2228 taskmgr.exe Token: SeSystemProfilePrivilege 2228 taskmgr.exe Token: SeCreateGlobalPrivilege 2228 taskmgr.exe Token: 33 2228 taskmgr.exe Token: SeIncBasePriorityPrivilege 2228 taskmgr.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe 2228 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shellcode.exe"C:\Users\Admin\AppData\Local\Temp\shellcode.exe"1⤵
- Checks processor information in registry
PID:536
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵PID:2904