933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

exe/non crypted/Darkgate 5864 port sample not startup/index.html
Size

357B
MD5

81a0a9ea5bad0982db117183726f1300
SHA1

56630b086e3bb78c08785f410fe5d7eefaab775a
SHA256

8dc2fe91915162ebe0393d4d50aa0aa757c68d96968f6887f6e6b546e5f3f880
SHA512

a97857fd1d039cae83ff3418623bd49aea020cc9512adb046f3f591ac8e2661f135f2842d014f69a8042b6ee0125e2664b41638d773f93e97ba4cbe7dd94b115

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e1f364daf1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000009e21a1c8ce47bd81945e671a2ea7e68b8e2446521ad7b13b05d00da359bc90b8000000000e800000000200002000000077f828fa791da6b1ce6a356198c0236def33ce47bb48f7038cff4d522a1685142000000058bfb57f3844f7681681440975a83e613e693da0cc604280cb18c6f302550daf400000008713e5bf3efeb61d94c38276ace97abd2224995aa11cdf8d81c21e4512680b79370237198e3ef8f29fd46a8a8f6561a8de655747281d88017e675e011c960b1d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430194161"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9068AA41-5DCD-11EF-BD75-DA960850E1DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000d714bfa2411e49c3be5cfb411dd9f6381407c2aa77a2890d9fbbff707d1f2bd0000000000e80000000020000200000004c92ecc26ba2a8024071b225b61fde15bc444cfffba825f7d4c730563bc9f7ec900000001d6b0d94f9d708868e83195513004a0a3e4aa046738b35760adefb8d4dce5790cf1e46df765499cd8322668df03f60225831abb0340194e53858970c6ece63b006a2147a6e15aa4944bc26e752110dc21d810351fc816876c7c8250e65c5c3915795801017cb304069d1fa8d3c1263f1a51b224baccb5eefe5d46c32c9d13740299d0b9f4594d9758ceef0b34c56243e400000009193a10178710e844437ce130a2d7082d6ab5e0aee572c29a066de898f57070f22b9c161d6b2329a24548b355b613eccc18992d5ce94f419a2f418c71c1c8e06	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2412	2536	iexplore.exe	31
PID 2536 wrote to memory of 2412	2536	iexplore.exe	31
PID 2536 wrote to memory of 2412	2536	iexplore.exe	31
PID 2536 wrote to memory of 2412	2536	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\index.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9e75604646b43cf36a2674c79d6353e

SHA1
c1b874b97bd23e03631ec5ab424ff6b454c86704

SHA256
ee026398f9700320b2800a49bc385b79bde9d16559a61cf0d1c53398a219fdd7

SHA512
7f4a86f556015450b48763542bcdd7553d7141b137c4dd9e94ed8ca00e26be9493b5d9d3d4755193d231e23aa5950cf2c3eff82c997c514b85be707fa467fc51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5efb8bf65b7382d6400a6f5998aa3ce

SHA1
36a9d8f4b23a55bb142ad7a615b894e30489c65c

SHA256
1d7e062874d8fa2ae103a014a90ea78427cadb3b373a279a3305e0ca43efe7f3

SHA512
ed0f11332c6f4b3733ca6bd9da1a09073492be903d1a7001d2305a2a348f35fbe29ed90e230b710289451bd43f75965cadd63550c051378427aefcf96ba019f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4c32b00a05601a81833e77e8727963e

SHA1
d8c8ea577cee35a1a96ccfb3cf3da1cbcf550baf

SHA256
2fd919d2b0a5ee9bc20ec0b75f4112e6200da8ec4527e4e80a4816a15c7c146e

SHA512
27bcb1c2bf58d5158231c8c7950b5cd6705f2c50ac9366debd61ad2c59b231ad8b6e4eb05a74f24e156a90c50f7e9efe2c9d43822a9aca32ef276de4a1a13843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59bc83c32e0538a4b5637b84a69ff1b4

SHA1
00a897e954e5bc528c02d2e8b55bf40e060feee4

SHA256
3a14ecebe9bc53d51ea47f17d7668f762b29925da5652b539b73f1c9997ef263

SHA512
d76f87150348978af1f0b4afabadff55b1274636c8d9a5f6d508aaae48af455157220cac4c7c9da55875f5a8e2dfed2faa09ce48afa7a5a2b7a6fe1060bc7ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b1faa4150582c71fe131be7a320cb9a

SHA1
ff0b34db940f3fcfbfca38027a4c4fa0d4e475b0

SHA256
d2cbb65a4dfd6269e5bfcf28a58b158bbd1df99cd4909a2788db394014476847

SHA512
13101ea5d98caaba9e7872ba8a6a6e98a944c9bf661e7ef6fe562dc11a02f06a50e3adc8352e395db035538af94c62c52aed41ffb61afbf26c81e7bac249057a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ada28744c3f6507449d3560c4141ed46

SHA1
d0d2660e25acf304e40bab68135bcbc5e640ce8e

SHA256
dd9c3fe2907e529948465e758b12f6f9a3bd2851d8f897b6b72ae7a850619864

SHA512
f17c1230a6929d2904661134df28bf86933a3389eb6cdcb65f441cc24db9a31bb7e381f0a1beaa4124810c064b6d754b8f932bd05c5d19f5b236220341582f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d57d81173a792b51d94cc7bdd2aa5da4

SHA1
ae7b4fa68010bcaf254154e6be021894fd52ada3

SHA256
d2e3092ba0658dc83394756385eab700f485f1eddedd3170dd305a76cf560a5e

SHA512
b4b8d7d87dbfa9f34a1f0df2e84264c97f644713b9dec458b850bf179da22e497a80760dcb23b8f13c260157c4ddef34108651be4873313281f564cb24ae8f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
601202340679e0e0e646c339b361adaf

SHA1
bc4d9e01db63a5b00b06f440c6dad3840bed98ed

SHA256
87462bb9f133fc977f51aafc7168b5b415662d28e2e90dab8a2b0987ed018324

SHA512
67102880981f00b0d701723cc0e3e44835206a768c8efe8d45c07dc8699887221157aa60e130805f2065d142b36b36f1758cf52f77dabd7e7582fdd0cd390498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0116fa522678d29d9fce3ed7576b7c9e

SHA1
b07d24edb1679f38641d6bc5bf0544dec00cddc2

SHA256
1ae787ab7d9f12ba4fe708dd352f120d132ff7580803a92a026123bf463c52ca

SHA512
be5afb14c3d2cbc144a8f43900cf8209cc3491b36125bd8dd1a674c34d660b3cbc75d55b7036036f447e4f604614f80cc595a85d4ff7ed1fde8fcda1b7abd073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb5b2edd0f0ce4993f2854210c9fbac3

SHA1
1265e40c34bbf752397fe223fb7277818c269c7f

SHA256
ba8ac318531f9f7be73c440e327d9d61421f1ca0fb9d7783033ed98d4fd39335

SHA512
41c939cd49cd91fe1533cfe3c0059bd0792d3623e9d7bbae54d263c7a31d96d36e9b15059f20fb766d79e8d9c3e0beaf4fe7078d6d35c6f5efa09161e84c0183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a19be9ecc71714bf47d19c7768fcc58

SHA1
93640310435a91f7004bc118bc0dab49cd9440e5

SHA256
6bcc7e257e699e168fdb582ace0b6a4a610dc64a6b6f1078ad5b4b0d3b2e5dee

SHA512
b87afee315ca72fc17bb0590ba5884c28f00cc5bc7e80f3ce7ee5b7a0cacae83d03ef29153e717b46b995a3bea009905aea82017c2d4ddae74a91dbe30b59a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b2b2bb913712d2c76b6a9529e223a19

SHA1
5f2b0e027b2a107962b6d1e80bca47da66dc3a4e

SHA256
3cb9ba040b55c6b7a58a093626780781ca9813667f03c7126738b63af940f953

SHA512
bbd24dd9248c998bbf972e7b74d214a4463e72816544c3f3254937b70e32a6bc7c023b3e8fdc722b6520c72c682d3ae24350e54c595ee3f1122ad51a7af6216c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
779f7dd69664b679fd2335ab1b052865

SHA1
156bc9fde9d98cc2d11b21babab9019dd53986af

SHA256
6f8654fd1c3697f306e232203d66645a67fb0e3b4f403733853f73df003c868f

SHA512
6edebeb9cf8d6e8069455641e1de3d86583f614cbbf2a6a035abf18db8be5e9848aac379e11bc540f1d08a65c2b0d72a9d945f4149a2204b27320454336cc37f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11b78a650f29a34e6b68250353313640

SHA1
2621fa5c7a08f948129fd19ad7c41ef3a2d1b140

SHA256
ec97d84166787ebc006be532ed52032d892f154b5d12f6ac517db206bc54aa71

SHA512
29d2f990e60f18c2c30e559a572769bfeba7d1ce882423430712b8ad9f593037afa6235d03925a1506de64966a407b58eec86a66d0e5bcced353a8994a40e9b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81144f16ac046031f8cc714eb2216e4

SHA1
f7c15f9756ac328cbd01242965b804c16930e08f

SHA256
128893798a0aef02ad801a6bffc9786eebfc8230ebab582ba786fc06c661c6d0

SHA512
dada0f9e978635c7a2c31eda9af70a3839f4d546407203d53cf2c76cb5a312bc4f3b123eb1f36a727ecff2682aaef79073bc4be8487996d75f7b3cbfce06f347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d8aac8c854396f35f314f0c8d734a20

SHA1
0ba58dd4f71aee550969f813258eec4e0ad7ef31

SHA256
5d8ec486d3250303b281920960f072c52dec1ed8a7fc335e09da26d892019023

SHA512
4a076bb8dcb00668d31eb38ccb8c4c9bde932d67959d572b53af0a18022bf270ebe608d855ea6407dbad64868630e8a8d92cd613042be7a957bbb291b2b2ed06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5238eee7490d461fedf8a4644bb90aab

SHA1
60a2cdbe52e602ee0938bbed4b161d6fd90ae0ed

SHA256
e2911ab36004576a857d2767b045522e0ba663800412397bf3f45c1c78f68bde

SHA512
a64e8ea698139afb12bd4fea5f730b0239328f38c01d666ee1e05f14edf9c2eef73ab4fe35c5330b421925ad74fc2d350baae714ce7ec3f26f96f92e8fd497be

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF644.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF6C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit