darkgate | fc1e22941deb9e33b5e9be3e0a8b4b3fb984bb93e758f6d82d7f13b65b01035a

Resubmissions

08-12-2023 10:57

231208-m2n9qsah27 10

02-10-2023 13:37

231002-qw6tdacg64 10

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mkpub_darkgate_ukarin.exe
Size

481KB
MD5

9a816db6737e39cf4e1fb2c03e57d3a5
SHA1

fff1fae72406cb73c4e42d1a3c0b597eef38196a
SHA256

fc1e22941deb9e33b5e9be3e0a8b4b3fb984bb93e758f6d82d7f13b65b01035a
SHA512

d67526a98d88d2bcec277beea08efaef3302f26476dd9dde8d19c02d0bdb1cb32f306c7fecbb85644b1e7e983423742e8efe609a531846cb36a6a06f44dbd39a
SSDEEP

12288:73wfF2uWIOyAxbhWyElk3Xb8ruWqW3GMRIYQIpe9qnu5/9aJCE:7S2uWyAXWyElwL8rjv3qYdpe9+u581

Score

10^/10

darkgate stealer

Malware Config

Extracted

Family

darkgate

http://81.19.135.17

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mkpub_darkgate_ukarin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mkpub_darkgate_ukarin.exe

C:\Users\Admin\AppData\Local\Temp\mkpub_darkgate_ukarin.exe
"C:\Users\Admin\AppData\Local\Temp\mkpub_darkgate_ukarin.exe"
1⤵
- Checks processor information in registry
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-0-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download