Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
02-10-2023 13:37
General
-
Target
mkpub_darkgate_ukarin.exe
-
Size
481KB
-
MD5
9a816db6737e39cf4e1fb2c03e57d3a5
-
SHA1
fff1fae72406cb73c4e42d1a3c0b597eef38196a
-
SHA256
fc1e22941deb9e33b5e9be3e0a8b4b3fb984bb93e758f6d82d7f13b65b01035a
-
SHA512
d67526a98d88d2bcec277beea08efaef3302f26476dd9dde8d19c02d0bdb1cb32f306c7fecbb85644b1e7e983423742e8efe609a531846cb36a6a06f44dbd39a
-
SSDEEP
12288:73wfF2uWIOyAxbhWyElk3Xb8ruWqW3GMRIYQIpe9qnu5/9aJCE:7S2uWyAXWyElwL8rjv3qYdpe9+u581
Score
10/10
Malware Config
Extracted
Family
darkgate
C2
http://81.19.135.17
Signatures
-
DarkGate
DarkGate is an infostealer written in C++.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mkpub_darkgate_ukarin.exe"C:\Users\Admin\AppData\Local\Temp\mkpub_darkgate_ukarin.exe"1⤵
- Checks processor information in registry
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
512KB