darkgate | 329db242a00f0dcf4e2f6390b06c837fd992cabb2cc4d0eda8278a8c57d4b044

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/02/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2023-10-12-decoded-EXE-retrieved-by-au3-script.exe
Size 388KB
Sample240207-drfp6scbb6
SHA256 7fc3126b9c53816657076b62188f9905067ec4b070deea5999cd6d7aa3c85c76
MD5 d90f88cd13ddbd5273133dc5fc062f19
SHA1 c7161197ef24a856106abc8b5c1946b6a51e686c
SHA512 944295a3a87fa34a90a1f7450d015e5c0d81ea9dcaf02e1e3a3880f1e8a240e9a89b8eb08a3776f90ac0dccd9e9bccf547c63628d240c05cfc94ac55b9170a90
SSDEEP 6144:s50tl7kAfri5ZhtWtIv9n0YQFaVfTnU6UVtmSaq1nMyCC3gT2Pt:a0tlBi5ZhtWtIv50genz91n1CC3j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate ricoc3 stealer

Malware Config

Extracted

Family

darkgate

Version

5.0.19

Botnet

Ricoc3

http://hgfdytrywq.com

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
VRXdjHZqDRJqyD
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
Ricoc3

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

resource	yara_rule
behavioral9/memory/2504-4-0x0000000000400000-0x0000000000467000-memory.dmp	family_darkgate_v6
behavioral9/memory/2504-5-0x0000000000400000-0x0000000000467000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2504 created 1092	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	12

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2504	WerFault.exe	27

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe
2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2196	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	28
PID 2504 wrote to memory of 2196	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	28
PID 2504 wrote to memory of 2196	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	28
PID 2504 wrote to memory of 2196	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	28
PID 2504 wrote to memory of 2224	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	29
PID 2504 wrote to memory of 2224	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	29
PID 2504 wrote to memory of 2224	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	29
PID 2504 wrote to memory of 2224	2504	2023-10-12-decoded-EXE-retrieved-by-au3-script.exe	29

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:2196

C:\Users\Admin\AppData\Local\Temp\2023-10-12-decoded-EXE-retrieved-by-au3-script.exe
"C:\Users\Admin\AppData\Local\Temp\2023-10-12-decoded-EXE-retrieved-by-au3-script.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 408
  2⤵
  - Program crash
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-4-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2504-5-0x0000000000400000-0x0000000000467000-memory.dmp

Download