Resubmissions
19/08/2023, 04:49
230819-ffsxgaga73 319/08/2023, 04:47
230819-fek58sga46 319/08/2023, 04:35
230819-e7wa8shd8y 519/08/2023, 04:30
230819-e41fsahd8s 519/08/2023, 04:27
230819-e3a5haga32 519/08/2023, 04:24
230819-e1wy7ahd7t 516/08/2023, 13:07
230816-qcxflacg8x 5Analysis
-
max time kernel
63s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
19/08/2023, 04:24
General
-
Target
DarkGateLoader.exe
-
Size
24.5MB
-
MD5
90262f95bf3a705ab9d23cde1f415655
-
SHA1
dc9f7383403df475173be606de1c4c61836dba73
-
SHA256
44d678f7cae23769cf2b9d59cb114b990c18d8a106de41526e4f9685d5331048
-
SHA512
3e6e23b8154ecaaaca27da5f73d5135b507621d7aeaad14deb5ded92bc61ba694760c1340e0264e44ebbe94a479738cd9ccf664415a94f8263234fdd289bcc45
-
SSDEEP
196608:73esNoeoCxZ1Ev7L0dtbqvLSOJJ4VvL2iSY/VCMzEqcVqeCqe:73esNoeoCYL0dtmj7JJJWCMzE5TC
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DarkGateLoader.exe"C:\Users\Admin\AppData\Local\Temp\DarkGateLoader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\Users\Admin\AppData\Local\Temp\DarkGateLoader.exe2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1320 -s 83⤵
- Program crash
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 1320 -ip 13201⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
25.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
25.2MB
-
Filesize
4KB
-
Filesize
25.2MB
-
Filesize
340KB
-
Filesize
25.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB