Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
02-11-2023 01:45
General
-
Target
02112023_0945_drkgate_fksg.exe
-
Size
405KB
-
MD5
170ad0deeecd0ad23a78799d9684e304
-
SHA1
f65f0cc599eebb8027a4dbb288c6fb032a61515f
-
SHA256
2f5c49999af5e428225f389020211ffed81feabec5f5d2d3863b6225abddb2ac
-
SHA512
af3e8532b9ca6ece682e35692f2c77b41a1d691493bda7e6ed2a49e6f2853bcc578595b77e0e1d1813714d096e794f536aff0fa3266bf87d2b10b047a728b46c
-
SSDEEP
12288:xUTExWnLjH5XOLiVtikJ537m/DWwtdeH1czUP:xHxWLT5XOLiVtj5rm/awOV8UP
Score
10/10
Malware Config
Extracted
Family
darkgate
Botnet
user_871236672
C2
http://shsukadadyuikmmonk.com
Attributes
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
true
-
c2_port
2351
-
check_disk
true
-
check_ram
true
-
check_xeon
true
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
WccksaEfoXLLtV
-
internal_mutex
txtMut
-
minimum_disk
50
-
minimum_ram
6001
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
user_871236672
Signatures
-
DarkGate
DarkGate is an infostealer written in C++.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\02112023_0945_drkgate_fksg.exe"C:\Users\Admin\AppData\Local\Temp\02112023_0945_drkgate_fksg.exe"1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404KB