Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 06:34

General

  • Target

    index.cmd

  • Size

    26B

  • MD5

    e111e5f66ecb1318ce9f10d52552bca9

  • SHA1

    734f9c72e4e90ce67eb34fc7b372a676c3f4b1a2

  • SHA256

    c4a8c37c1edca2eb1e6140c7b72283591e016f0a17231ea283c67eebbbbbe545

  • SHA512

    6c66fc8280ada0f1f16f940e621a5b075260adc4bb7e6d70188eca90eb391334ea9471334cec90ec6c0d215731d6c67020f9acf0e551a6f14b1db248ad8d8f43

Malware Config

Extracted

Family

darkgate

Botnet

trafikk897612561

C2

45.11.59.81

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    QOjojiwc

  • minimum_disk

    100

  • minimum_ram

    4095

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    trafikk897612561

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 2 IoCs
  • Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs

    Using AutoIT for possible automate script.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\index.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Users\Admin\AppData\Local\Temp\Autoit3.exe
      Autoit3.exe script.a3x
      2⤵
      • Command and Scripting Interpreter: AutoIT
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1496
      • \??\c:\windows\SysWOW64\cmd.exe
        "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\fkaahfb\dccfhkc
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4280
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic ComputerSystem get domain
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\fkaahfb\dccfhkc

    Filesize

    54B

    MD5

    c8bbad190eaaa9755c8dfb1573984d81

    SHA1

    17ad91294403223fde66f687450545a2bad72af5

    SHA256

    7f136265128b7175fb67024a6ddd7524586b025725a878c07d76a9d8ad3dc2ac

    SHA512

    05f02cf90969b7b9a2de39eecdf810a1835325e7c83ffe81388c9866c6f79be6cdc8617f606a8fedc6affe6127bede4b143106a90289bbb9bf61d94c648059df

  • memory/1496-2-0x0000000001520000-0x0000000001920000-memory.dmp

    Filesize

    4.0MB

  • memory/1496-3-0x0000000004790000-0x0000000004B18000-memory.dmp

    Filesize

    3.5MB

  • memory/1496-6-0x0000000004790000-0x0000000004B18000-memory.dmp

    Filesize

    3.5MB