darkgate | 1fce9ee9254dd0641387cc3b6ea5f6a60f4753132c20ca03ce4eed2aa1042876

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231201-en
resource tags

arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
submitted
07-12-2023 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07122023_1012_drkgate_06122023.exe
Size

405KB
MD5

c0239ed784365306e722a02bee17f9bc
SHA1

0b2f3354c933a3e0a4660a845b07f65ec674b337
SHA256

1fce9ee9254dd0641387cc3b6ea5f6a60f4753132c20ca03ce4eed2aa1042876
SHA512

0994e094818a6543e1600d569f76b472b05cc29ef1a14d90bdcd044889fcde7570fca3d6c9a76cb0556bb2307cc977a20d480d713c208c36cb5e0f4dbbcd0c09
SSDEEP

6144:m5UHKhp9UQpT0E3OWRytzcUE/Gm1GML4xVDbzKlogClfwkJKblY:QUHKJ0E3OWRytCn3L4x9bmlogClokJx

Score

10^/10

darkgate blabla stealer

Malware Config

Extracted

Family

darkgate

Botnet

Blabla

http://cdn-uk.widgetsfordeploy.com

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
443
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_rawstub
true
crypto_key
eYDWtvhQLehhlA
internal_mutex
201120
minimum_disk
100
minimum_ram
4070
ping_interval
11
rootkit
true
startup_persistence
true
username
Blabla

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 2180 created 1112	2180	07122023_1012_drkgate_06122023.exe	19
PID 2180 created 1112	2180	07122023_1012_drkgate_06122023.exe	19
PID 2180 created 1168	2180	07122023_1012_drkgate_06122023.exe	12
PID 2180 created 1112	2180	07122023_1012_drkgate_06122023.exe	19
PID 2180 created 1168	2180	07122023_1012_drkgate_06122023.exe	12

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	07122023_1012_drkgate_06122023.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	07122023_1012_drkgate_06122023.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2180	07122023_1012_drkgate_06122023.exe
2180	07122023_1012_drkgate_06122023.exe
2180	07122023_1012_drkgate_06122023.exe
2180	07122023_1012_drkgate_06122023.exe
2180	07122023_1012_drkgate_06122023.exe
2180	07122023_1012_drkgate_06122023.exe
2180	07122023_1012_drkgate_06122023.exe
2180	07122023_1012_drkgate_06122023.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Users\Admin\AppData\Local\Temp\07122023_1012_drkgate_06122023.exe
"C:\Users\Admin\AppData\Local\Temp\07122023_1012_drkgate_06122023.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-3-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2180-5-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2180-6-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download