Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-07-2024 18:53
General
-
Target
2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29.exe
-
Size
3.2MB
-
MD5
4b362951de01e8de774ff98d1fcd04ce
-
SHA1
5b433fe0dbd449f6a04388fade733f0d1d250252
-
SHA256
2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29
-
SHA512
5f1d793e930374fbf3b5cca767605a7ee2cfd48d95eea4f273e7a70e043c19dae3669ab471ec2d0a98d9454eb6edc83ec5335918c26190e04de6770642e1628e
-
SSDEEP
49152:dsjxBrEi/YD4ocuJ5txUJGvSEmrxlbTT1zVIZZpEkQuPQLAkOWMuG8lAKRRmxvIy:dsjxBrEMYD4ocuEbr1yZERuYLi/imKNE
Malware Config
Extracted
darkgate
trafikk897612561
91.222.173.204
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
WRYOnwPR
-
minimum_disk
100
-
minimum_ram
4095
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
trafikk897612561
Signatures
-
DarkGate
DarkGate is an infostealer written in C++.
-
Detect DarkGate stealer 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
-
Drops file in System32 directory 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Runs net.exe
-
Runs regedit.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29.exe"C:\Users\Admin\AppData\Local\Temp\2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\st\Autoit3.exe"c:\st\Autoit3.exe" c:\st\script.a3x2⤵
- Executes dropped EXE
- Command and Scripting Interpreter: AutoIT
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\cmd.exe"c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\fcfcbbc\kagghba3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get domain4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54B
MD5c8bbad190eaaa9755c8dfb1573984d81
SHA117ad91294403223fde66f687450545a2bad72af5
SHA2567f136265128b7175fb67024a6ddd7524586b025725a878c07d76a9d8ad3dc2ac
SHA51205f02cf90969b7b9a2de39eecdf810a1835325e7c83ffe81388c9866c6f79be6cdc8617f606a8fedc6affe6127bede4b143106a90289bbb9bf61d94c648059df
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
544KB
MD54e3d009d727a33cf4382bd1198ecfcf6
SHA186000c28ea25a15362f491bc0301e66a782901ce
SHA2568c53a0cb385ab07882e03d6da17ea58d5d483613fe95a45b812b9e8defc693c7
SHA512594eabf58c425ddcacbe38684d5e272a9f9929c30dda167438ef2d96976d6d510b948f4ebd7ade53dd936f36ac07e70b5e758f3bc1aca3656625204dbb96b064
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
22.5MB
-
Filesize
22.5MB
-
Filesize
22.5MB
-
Filesize
5.2MB
-
Filesize
22.5MB
-
Filesize
22.5MB
-
Filesize
22.5MB
-
Filesize
22.5MB
-
Filesize
7.3MB
-
Filesize
22.5MB
-
Filesize
712KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
4.0MB
-
Filesize
3.5MB