Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2025, 08:09
Behavioral task
behavioral1
Sample
2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe
-
Size
973KB
-
MD5
97b25ff717bbbec7863bab2e6a7cf1cb
-
SHA1
45577be5cff8877bdfecaa3e53c9d4f87800a60c
-
SHA256
a73097a2473040ef00430e3bf37e00253d2a92e83ffa91fd8439d20e22760c6c
-
SHA512
b1b855185741999e2fb0071d305873f5b21bf6e82e43770cea897d6376602180ecd7691584bf726fdb5b3db1b7b5f2c120566b32cd6d395e9b9b6c0ef7ac51b2
-
SSDEEP
24576:N5r3iOAYe5xyrXKYZd8nixN/pSUCpM2W1GvgmyeRvJ:ui5xC61GyovJ
Score
10/10
Malware Config
Signatures
-
Detect Umbral payload 3 IoCs
resource yara_rule behavioral2/files/0x00350000000237db-4.dat family_umbral behavioral2/memory/3988-33-0x0000000000400000-0x00000000004FB000-memory.dmp family_umbral behavioral2/memory/2008-22-0x000001905B180000-0x000001905B1C0000-memory.dmp family_umbral -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe" Trojan.exe -
Umbral family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe -
Executes dropped EXE 3 IoCs
pid Process 2008 ûûû.exe 5820 dll.exe 5764 Trojan.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe" Trojan.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2008 ûûû.exe Token: SeIncreaseQuotaPrivilege 4816 wmic.exe Token: SeSecurityPrivilege 4816 wmic.exe Token: SeTakeOwnershipPrivilege 4816 wmic.exe Token: SeLoadDriverPrivilege 4816 wmic.exe Token: SeSystemProfilePrivilege 4816 wmic.exe Token: SeSystemtimePrivilege 4816 wmic.exe Token: SeProfSingleProcessPrivilege 4816 wmic.exe Token: SeIncBasePriorityPrivilege 4816 wmic.exe Token: SeCreatePagefilePrivilege 4816 wmic.exe Token: SeBackupPrivilege 4816 wmic.exe Token: SeRestorePrivilege 4816 wmic.exe Token: SeShutdownPrivilege 4816 wmic.exe Token: SeDebugPrivilege 4816 wmic.exe Token: SeSystemEnvironmentPrivilege 4816 wmic.exe Token: SeRemoteShutdownPrivilege 4816 wmic.exe Token: SeUndockPrivilege 4816 wmic.exe Token: SeManageVolumePrivilege 4816 wmic.exe Token: 33 4816 wmic.exe Token: 34 4816 wmic.exe Token: 35 4816 wmic.exe Token: 36 4816 wmic.exe Token: SeIncreaseQuotaPrivilege 4816 wmic.exe Token: SeSecurityPrivilege 4816 wmic.exe Token: SeTakeOwnershipPrivilege 4816 wmic.exe Token: SeLoadDriverPrivilege 4816 wmic.exe Token: SeSystemProfilePrivilege 4816 wmic.exe Token: SeSystemtimePrivilege 4816 wmic.exe Token: SeProfSingleProcessPrivilege 4816 wmic.exe Token: SeIncBasePriorityPrivilege 4816 wmic.exe Token: SeCreatePagefilePrivilege 4816 wmic.exe Token: SeBackupPrivilege 4816 wmic.exe Token: SeRestorePrivilege 4816 wmic.exe Token: SeShutdownPrivilege 4816 wmic.exe Token: SeDebugPrivilege 4816 wmic.exe Token: SeSystemEnvironmentPrivilege 4816 wmic.exe Token: SeRemoteShutdownPrivilege 4816 wmic.exe Token: SeUndockPrivilege 4816 wmic.exe Token: SeManageVolumePrivilege 4816 wmic.exe Token: 33 4816 wmic.exe Token: 34 4816 wmic.exe Token: 35 4816 wmic.exe Token: 36 4816 wmic.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe 5764 Trojan.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3988 wrote to memory of 2008 3988 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe 86 PID 3988 wrote to memory of 2008 3988 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe 86 PID 3988 wrote to memory of 5820 3988 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe 88 PID 3988 wrote to memory of 5820 3988 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe 88 PID 3988 wrote to memory of 5764 3988 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe 89 PID 3988 wrote to memory of 5764 3988 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe 89 PID 3988 wrote to memory of 5764 3988 2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe 89 PID 2008 wrote to memory of 4816 2008 ûûû.exe 92 PID 2008 wrote to memory of 4816 2008 ûûû.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-25_97b25ff717bbbec7863bab2e6a7cf1cb_darkgate_ngrbot_ransomlock.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\ûûû.exe"C:\Users\Admin\AppData\Local\Temp\ûûû.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
-
C:\Users\Admin\AppData\Local\Temp\dll.exe"C:\Users\Admin\AppData\Local\Temp\dll.exe"2⤵
- Executes dropped EXE
PID:5820
-
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5764
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4980
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD59d40061e58fdf0e3c3bfbe8541ec83bd
SHA106f1f81d6278af3afe79e44120d2604fbe2ec022
SHA256a15c7f4653ded3d0c1639e3409f3f5a583c7e446b71f9b585aff305d02403f6e
SHA5121d132b65d840a1b6012cd33a5011c33ad77d8c8f4d78d149acd041e10ac24e591156d868ceb02147ea33530a284d614e3b4937ba6f5d9e07fac78000828c3603
-
Filesize
301KB
MD5ea5800c82ef7b0929307948391709539
SHA1a85be900314791905a77b6f97ce9cb2754ad16ff
SHA2564aeaf773e3d50df877f407d547d9a42d49c2263e414710bdf04c968cd628a502
SHA512b4b77c999c637b7f5204f2c643794532e541577e377e01d42ce5025f6c20408555788619c348a26b8a4974ee978abc105ebed8b89b800627bee31655503fca43
-
Filesize
227KB
MD554e5d52122e173e267bae183e51a883a
SHA161074f26a9dd5aeaea6e208b461196f19392c903
SHA256e4566da9e8ce5469834e93fc6d2ea6558c069ec30c0652b94f423d61719ef876
SHA5125c0a776c33c150a14d1547b6485d616752f32852f1d99b2a614a2413bf91376873d9d53fac9511d7a2e4b14c431278baceaceab8dd547cd7ada96fda40898fe2