Overview

overview

10

Static

static

8

0.jpg.exe

windows7-x64

10

0.jpg.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 16:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0.jpg.exe
  • Size 4.2MB
  • Sample240305-twc3vaba7s
  • SHA256 8a2edeef9978d454882bfb233d9cd77505618b854f7899b27aeb095ff8ebb3f4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
darkgateadmin888stealer

Malware Config

Extracted

Family

  • darkgate

Botnet

  • admin888

C2

  • afdhf198jfadafdkfad.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    lrDcZuOq

  • minimum_disk

    50

  • minimum_ram

    7000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate
  • Detect DarkGate stealer 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0.jpg.exe
    "C:\Users\Admin\AppData\Local\Temp\0.jpg.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2940
    • \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.a3x
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      PID:4316

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Autoit3.exe
        • Path C:\temp\Autoit3.exe
        • Size 872KB
        • SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        script.a3x
        • Path \??\c:\temp\script.a3x
        • Size 468KB
        • SHA256 dbb900ab8d921e3faccd6bb827353683e80be4e4ae530488bc90559251e85c2d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        test.txt
        • Path \??\c:\temp\test.txt
        • Size 76B
        • SHA256 4be8f8d0446ecf4d3213ab354e15591428576531acf5af60f6f07e770944bcdd
        • MD5 SHA1 SHA512
        Submit Download

        memory/2940-1-0x0000000002C40000-0x0000000002D9F000-memory.dmp
        Download

        memory/2940-6-0x0000000002C40000-0x0000000002D9F000-memory.dmp
        Download

        memory/4316-11-0x0000000004140000-0x0000000005110000-memory.dmp
        Download

        memory/4316-12-0x0000000005630000-0x000000000597F000-memory.dmp
        Download

        memory/4316-13-0x0000000005630000-0x000000000597F000-memory.dmp
        Download