Overview

overview

10

Static

static

1

a777dd29c0...a5.lnk

windows7-x64

10

a777dd29c0...a5.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a777dd29c0c24492eae7a4170d1599a5.bin

  • Size

    1KB

  • Sample

    240312-eatq5she22

  • MD5

    a777dd29c0c24492eae7a4170d1599a5

  • SHA1

    a854b705c05dd4503d6de331cf1ad2716221c230

  • SHA256

    f31c862a31ee968dafb32532059403438d2cfa5aaf8b5b1ad089b6ac027cec34

  • SHA512

    5b0a100f1d0f61f3f87cc0f00e1be2096e009fe7b690dd37f32a4e3bb1d47495130e604f013ec1cf8f0616262b65d46090f5c3c81ee04172a9736a2b37994425

Score
10/10
darkgateadmin000persistencestealer

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://206.188.196.222/w1

Extracted

Language
hta
Source
URLs
hta.dropper

http://206.188.196.222/w1

Extracted

Family

darkgate

Botnet

admin000

C2

145.239.202.110

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    8094

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    WXMqRdAD

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin000

Targets

    • Target

      a777dd29c0c24492eae7a4170d1599a5.bin

    • Size

      1KB

    • MD5

      a777dd29c0c24492eae7a4170d1599a5

    • SHA1

      a854b705c05dd4503d6de331cf1ad2716221c230

    • SHA256

      f31c862a31ee968dafb32532059403438d2cfa5aaf8b5b1ad089b6ac027cec34

    • SHA512

      5b0a100f1d0f61f3f87cc0f00e1be2096e009fe7b690dd37f32a4e3bb1d47495130e604f013ec1cf8f0616262b65d46090f5c3c81ee04172a9736a2b37994425

    Score
    10/10
    darkgateadmin000persistencestealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks