darkgate | d8d513342e727b085859cb3cece7efbd71851cd5d59f80100e01c6b6b507211d

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2472-15-0x0000000000770000-0x00000000007D7000-memory.exe
Size

412KB
MD5

16ec458758cb0f40bd758e6ebb8b384f
SHA1

3c28d1e765d8de4bc7ff8939c2aa333b0dbb51e2
SHA256

d8d513342e727b085859cb3cece7efbd71851cd5d59f80100e01c6b6b507211d
SHA512

da8648307b1335a4fda60f17f6994e43411cec77d498186156e2979cdb83a7273bdbd776b7f1b72b925f86293beb59eaf6441250164f6c330d81971059951aca
SSDEEP

6144:pfZk2/Zu30WbMAOozifhNay3p3yra20fSjtPJ5AOSd1d:bkkZuEWzOozifhNarFjtBfif

Score

10^/10

darkgate ricoc3 stealer

Malware Config

Extracted

Family

darkgate

Botnet

Ricoc3

http://hgfdytrywq.com

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_rawstub
true
crypto_key
uwCQCDKnhIZhrE
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
Ricoc3

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2472-15-0x0000000000770000-0x00000000007D7000-memory.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2472-15-0x0000000000770000-0x00000000007D7000-memory.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	2472-15-0x0000000000770000-0x00000000007D7000-memory.exe
4528	2472-15-0x0000000000770000-0x00000000007D7000-memory.exe

C:\Users\Admin\AppData\Local\Temp\2472-15-0x0000000000770000-0x00000000007D7000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2472-15-0x0000000000770000-0x00000000007D7000-memory.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4528-3-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-4-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-5-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-6-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-7-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-8-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-9-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-10-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-12-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-15-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4528-16-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download