| File name: | RX7CDZ8L0ZRW50B3A.exe |
| Full analysis: | https://app.any.run/tasks/ec5f4fdb-8054-44ed-80c0-24aa5ea81598 |
| Verdict: | Malicious activity |
| Threats: | DarkGate is a loader, which possesses extensive functionality, ranging from keylogging to crypto mining. Written in Delphi, this malware is known for the use of AutoIT scripts in its infection process. Thanks to this malicious software’s versatile architecture, it is widely used by established threat actors. |
| Analysis date: | July 10, 2024, 22:32:58 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 1BCA1362C9124ED4DE6B4176A2ACB0A5 |
| SHA1: | 19B5C2CE4D51C4265535FFA64DC19BF17BA03A98 |
| SHA256: | CDB65B32A3700AD68B39EE7BB9F2AD270DBB7CC9134C29E534E29BCFD99FBCC1 |
| SSDEEP: | 98304:v3P2whNTAIlXAwPx+GaQXIu8CvsrchiysXfDfER8P7D57Ar4SRBSiGUWVutE6U68:cCvAk |
MALICIOUS
Drops the executable file immediately after the start
- RX7CDZ8L0ZRW50B3A.exe (PID: 1972)
- Autoit3.exe (PID: 4544)
DARKGATE has been detected (SURICATA)
- Autoit3.exe (PID: 4544)
DARKGATE has been detected (YARA)
- Autoit3.exe (PID: 4544)
SUSPICIOUS
Executable content was dropped or overwritten
- RX7CDZ8L0ZRW50B3A.exe (PID: 1972)
- Autoit3.exe (PID: 4544)
The process verifies whether the antivirus software is installed
- Autoit3.exe (PID: 4544)
Starts CMD.EXE for commands execution
- Autoit3.exe (PID: 4544)
Uses WMIC.EXE to obtain computer system information
- cmd.exe (PID: 4556)
Connects to the server without a host name
- Autoit3.exe (PID: 4544)
Contacting a server suspected of hosting an CnC
- Autoit3.exe (PID: 4544)
Accesses domain name via WMI (SCRIPT)
- WMIC.exe (PID: 444)
INFO
Checks supported languages
- RX7CDZ8L0ZRW50B3A.exe (PID: 1972)
- Autoit3.exe (PID: 4544)
Reads mouse settings
- Autoit3.exe (PID: 4544)
Reads the computer name
- RX7CDZ8L0ZRW50B3A.exe (PID: 1972)
- Autoit3.exe (PID: 4544)
Reads CPU info
- Autoit3.exe (PID: 4544)
Reads Windows Product ID
- Autoit3.exe (PID: 4544)
Creates files or folders in the user directory
- Autoit3.exe (PID: 4544)
Creates files in the program directory
- Autoit3.exe (PID: 4544)
- cmd.exe (PID: 4556)
Reads product name
- Autoit3.exe (PID: 4544)
Reads Environment values
- Autoit3.exe (PID: 4544)
Reads security settings of Internet Explorer
- WMIC.exe (PID: 444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (92.8) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.6) |
| .exe | | | DOS Executable Generic (1.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:05:21 05:56:25+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 2468352 |
| InitializedDataSize: | 3265536 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x25c4a4 |
| OSVersion: | 6 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 51.1052.0.0 |
| ProductVersionNumber: | 1.91.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| FileDescription: | Setup/Uninstall |
| FileVersion: | 51.1052.0.0 |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Microsoft Corporation |
| LegalCopyright: | |
| OriginalFileName: | |
| ProductName: | Visual Studio Code |
| ProductVersion: | 1.91.0 |
Total processes
137
Monitored processes
5
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 444 | wmic ComputerSystem get domain | C:\Windows\SysWOW64\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1972 | "C:\Users\admin\AppData\Local\Temp\RX7CDZ8L0ZRW50B3A.exe" | C:\Users\admin\AppData\Local\Temp\RX7CDZ8L0ZRW50B3A.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 4544 | "c:\temp2\Autoit3.exe" c:\temp2\script.a3x | C:\temp2\Autoit3.exe | RX7CDZ8L0ZRW50B3A.exe | ||||||||||||
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Version: 3, 3, 14, 5 Modules
| |||||||||||||||
| 4556 | "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\ddcceag\hagbfgf | C:\Windows\SysWOW64\cmd.exe | — | Autoit3.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5532 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
1 813
Read events
1 813
Write events
0
Delete events
0
Modification events
Executable files
2
Suspicious files
4
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4544 | Autoit3.exe | C:\Users\admin\AppData\Roaming\KBEFBbD | text | |
MD5:8FCEA2F4596867401EE88DA793607EF2 | SHA256:4AFFEEF730EC6BA16D7C498C3E342B51A93CF7851B80462DE6FC8F543CD3CB2B | |||
| 4544 | Autoit3.exe | C:\ProgramData\ddcceag\Autoit3.exe | executable | |
MD5:C56B5F0201A3B3DE53E561FE76912BFD | SHA256:237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D | |||
| 4544 | Autoit3.exe | C:\ProgramData\ddcceag\bdccdef.a3x | binary | |
MD5:F7C84718F5A6E7EB7773991C2E169444 | SHA256:63246C5262D798D906418BB11764D6014030FCA1B3BABC9020007F1019FE13FA | |||
| 4544 | Autoit3.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KBEFBbD.lnk | binary | |
MD5:0343F106050B2629F367EAAA821CECFE | SHA256:0EA68E24DB519E2397263D8F5A94FCC9CA968F2DD064DFAC4B30E1B409A08B60 | |||
| 4544 | Autoit3.exe | C:\temp\daahffb | text | |
MD5:4A6D665D1A90FB782DAD8461D318CB28 | SHA256:AD2D46B65930D9DD4FA40A1A7A66ECCA53BB1047ED63D4B02BAE8A8D9FC8E13B | |||
| 1972 | RX7CDZ8L0ZRW50B3A.exe | C:\temp2\script.a3x | binary | |
MD5:F7C84718F5A6E7EB7773991C2E169444 | SHA256:63246C5262D798D906418BB11764D6014030FCA1B3BABC9020007F1019FE13FA | |||
| 4556 | cmd.exe | C:\ProgramData\ddcceag\hagbfgf | text | |
MD5:C8BBAD190EAAA9755C8DFB1573984D81 | SHA256:7F136265128B7175FB67024A6DDD7524586B025725A878C07D76A9D8AD3DC2AC | |||
| 1972 | RX7CDZ8L0ZRW50B3A.exe | C:\temp2\Autoit3.exe | executable | |
MD5:C56B5F0201A3B3DE53E561FE76912BFD | SHA256:237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D | |||
| 4544 | Autoit3.exe | C:\temp\gaaaccg | binary | |
MD5:0343F106050B2629F367EAAA821CECFE | SHA256:0EA68E24DB519E2397263D8F5A94FCC9CA968F2DD064DFAC4B30E1B409A08B60 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
84
DNS requests
17
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
3716 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
4544 | Autoit3.exe | POST | 200 | 91.222.173.47:80 | http://91.222.173.47/ | unknown | — | — | unknown |
2056 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
2056 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
4084 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
7080 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
4544 | Autoit3.exe | POST | 200 | 91.222.173.47:80 | http://91.222.173.47/ | unknown | — | — | unknown |
4544 | Autoit3.exe | POST | 200 | 91.222.173.47:80 | http://91.222.173.47/ | unknown | — | — | unknown |
4544 | Autoit3.exe | POST | 200 | 91.222.173.47:80 | http://91.222.173.47/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
368 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4456 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2056 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
2056 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
4656 | SearchApp.exe | 104.126.37.171:443 | www.bing.com | Akamai International B.V. | DE | unknown |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4032 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
arc.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4544 | Autoit3.exe | Malware Command and Control Activity Detected | LOADER [ANY.RUN] DarkGate HTTP POST Activity |