e01cf9500da5d233d3f6e64f53933e9a2992c79273b73651a1ecbc6e9417bfeb

Resubmissions

21-11-2023 07:49

231121-jn3cnadg6z 10

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2023 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

darkgate.exe
Size

473KB
MD5

3f01158a510fa6c87565b40aa8ecd516
SHA1

7505dc832e0dc8412fa8150a6450fc2328f482fb
SHA256

e01cf9500da5d233d3f6e64f53933e9a2992c79273b73651a1ecbc6e9417bfeb
SHA512

f2e27ac78712599647bcef84683d4289b6cc80709eab7ed34ceb54f404e93c324dab5d9a2c29eac8c104df66842707397497f18f4fec09808bedb602836a5455
SSDEEP

12288:6IrqXlstKmmdtseWz9nwadGr7d4NysYs2iPR5hOAD5aaqnu3/tU2:6OksnmdtxWz9npdhNyY7R5RDh+uv7

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

description	pid	Process	procid_target
PID 3632 created 3780	3632	darkgate.exe	39
PID 3632 created 4000	3632	darkgate.exe	38
PID 3632 created 2328	3632	darkgate.exe	56
PID 3632 created 3780	3632	darkgate.exe	39
PID 3632 created 4000	3632	darkgate.exe	38
PID 3632 created 2408	3632	darkgate.exe	54
PID 3632 created 2328	3632	darkgate.exe	56
PID 3632 created 4000	3632	darkgate.exe	38
PID 3632 created 4000	3632	darkgate.exe	38
PID 3632 created 3900	3632	darkgate.exe	17
PID 3632 created 3624	3632	darkgate.exe	40
PID 3632 created 3900	3632	darkgate.exe	17

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	3632	WerFault.exe	82

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	darkgate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	darkgate.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings	darkgate.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe
3632	darkgate.exe

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3900

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4000

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3780

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3624

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2408

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2328

C:\Users\Admin\AppData\Local\Temp\darkgate.exe
"C:\Users\Admin\AppData\Local\Temp\darkgate.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 852
  2⤵
  - Program crash
  PID:2748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3632 -ip 3632
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3632-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download