darkgate | c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cccdbbb.au3.exe
Size

405KB
MD5

52fc04a1017bff949d2531942491e7d9
SHA1

0f23ac4f5dc0603894374026349d7db0f870ee91
SHA256

c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229
SHA512

920905dc5d7c25daf2ba38daeeeab8ffe883023905ecb166f585346b012caeb3629e12400ca0df4c24e23d2abdea8081f7272d3b1385121ffc301f2982a10c85
SSDEEP

12288:0UEpOEWzuYzy/Bda9AlxhwcySTcth/4N:0fOEWjyZda9uhwlSIf4

Score

10^/10

darkgate civilian1337 stealer

Malware Config

Extracted

Family

darkgate

Version

5.2.4

Botnet

civilian1337

http://185.130.227.202

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
true
anti_vm
false
c2_port
2351
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
VPsTDMdPronzYs
internal_mutex
txtMut
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
civilian1337

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 4488 created 3304	4488	cccdbbb.au3.exe	22
PID 4488 created 3304	4488	cccdbbb.au3.exe	22
PID 4488 created 2632	4488	cccdbbb.au3.exe	55
PID 4488 created 2588	4488	cccdbbb.au3.exe	56
PID 4488 created 3304	4488	cccdbbb.au3.exe	22

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cccdbbb.au3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cccdbbb.au3.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe
4488	cccdbbb.au3.exe

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2632

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2588

C:\Users\Admin\AppData\Local\Temp\cccdbbb.au3.exe
"C:\Users\Admin\AppData\Local\Temp\cccdbbb.au3.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4488-4-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download