Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
21/03/2025, 08:07
General
-
Target
2025-03-21_6cc3475b50469100df7c24810d48b89f_darkgate_luca-stealer_ryuk.exe
-
Size
30.6MB
-
MD5
6cc3475b50469100df7c24810d48b89f
-
SHA1
968829575a378d4d91af615db5e0f7e1db692694
-
SHA256
14356a2680d913a3e37991e9d7755d86a7c0c6203917c34b0ea422491f3b28ed
-
SHA512
54352b933f2c8b9fa44fb395c37ac72a54298068e55c9828f03172117bb9bb084e43e01522270876ed39f5d7b166641a74e3ce3035ef4ccda8e77ead8143db98
-
SSDEEP
98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMf:9nwngnwnBRRRVRO
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-21_6cc3475b50469100df7c24810d48b89f_darkgate_luca-stealer_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-21_6cc3475b50469100df7c24810d48b89f_darkgate_luca-stealer_ryuk.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30.6MB
MD5d824777583e7c57644089af8a04e0788
SHA1fe185f29c2e789da7b3dcf1c844e00fae8d16b63
SHA256e9463e58125efaaa02627ed6d30f5dcd91cea889f6b22ca5120eba98d3980f5f
SHA512640bd4965c5ff548b24688cfa9fe6d87051967097038590beed0a4ba6d83572a9c7c2d7ea3c547a32cdf929221b191fc1d67e5b5d9fa79fd9c33c10273258e1a
-
Filesize
1KB
MD5854e6978effd7288caa455bc53214f6a
SHA11a0fccb24b15107765d63a0c67a39b59889509d9
SHA2561b4a1f7d261426a02760ccfac19111f22bb858862116ed8b2aa77c40f6c7e853
SHA512eb95368b18603526c250dbc48e80333305384e21165100fb8e10f078b33abce8145613dea8ce89fc15ded51501dfbc17a113e9753e94ca689f6e470946cf73d7
-
Filesize
950B
MD55132b4aea8fabeb7672be47ff626cfcc
SHA1e25eb80dc6e8f3e95a52fa9be41155c96ceb9784
SHA256419e3f583fd73aa0cadf1e545a1825b9447469b6e1293a05f7b87e377d2ba17d
SHA5123d85359b0aef2f582da28b57f7e13865c2fd666acdbbb4991f4364c68602e8ffccc3198bd3b32ee6e18fa0d7f91fe92b1393978a8e3f5523122c0d53dd9b59a2
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
30.6MB
MD56cc3475b50469100df7c24810d48b89f
SHA1968829575a378d4d91af615db5e0f7e1db692694
SHA25614356a2680d913a3e37991e9d7755d86a7c0c6203917c34b0ea422491f3b28ed
SHA51254352b933f2c8b9fa44fb395c37ac72a54298068e55c9828f03172117bb9bb084e43e01522270876ed39f5d7b166641a74e3ce3035ef4ccda8e77ead8143db98
-
Filesize
29.8MB
MD5f9972814ce7382c5e6a3ca7f291aae48
SHA150f0b705a72f56093d72687d922f61e831f79a77
SHA256cfd5b179331e33274f8b901bf26eabe1c69666be589c8fa2268604dbe656792d
SHA51224d5a8c59bbf7ae65ae04031866beaa894775afe32c6c22a385963846d57ddeef79a0c7969d7aa6cd4ddf5fbd4335a8cff59e3963a52f9d0fe67ac7f97f9efc7
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
4KB