darkgate | 27c1008f283ea779e96e487038c4f0a34c355439cb97790998df4a178baaa433

General

Target

vlc.exe
Size

966KB
MD5

035860e139ba6db1b38d5346cb6ff5b6
SHA1

d515303cbca3a8ae7a0463fecd418d81b314e650
SHA256

16197a321fc7b0a2a311e689621fe4a7cd50fdcb2d163973a31e4fd6352232d7
SHA512

14dab9108d85af72001631130923b94483dd1440f24a8eedad41756db3030c5e11e80ec894922c389e09c86e8b721bcbd8594bd3646f484560f89963a7e18cc7
SSDEEP

24576:le3xAibB85Z1HrWtB8z1L1OQJK5zzz3zzzozzz3zzz2w:wxAibBEZ1LWtBznvw

Score

10^/10

darkgate admin888 spyware stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

newdomainfortesteenestle.com

Attributes

anti_analysis
true
anti_debug
false
anti_vm
false
c2_port
443
check_disk
false
check_ram
true
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
ZLhPAWah
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
false
username
admin888

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 12 IoCs

resource	yara_rule
behavioral5/memory/2376-13-0x0000000003790000-0x0000000004760000-memory.dmp	family_darkgate_v6
behavioral5/memory/2376-14-0x0000000004C10000-0x0000000004F5E000-memory.dmp	family_darkgate_v6
behavioral5/memory/2376-16-0x0000000004C10000-0x0000000004F5E000-memory.dmp	family_darkgate_v6
behavioral5/memory/2492-31-0x0000000003710000-0x00000000046E0000-memory.dmp	family_darkgate_v6
behavioral5/memory/2492-32-0x0000000004B90000-0x0000000004EDE000-memory.dmp	family_darkgate_v6
behavioral5/memory/2492-35-0x0000000004B90000-0x0000000004EDE000-memory.dmp	family_darkgate_v6
behavioral5/memory/2324-50-0x00000000036E0000-0x00000000046B0000-memory.dmp	family_darkgate_v6
behavioral5/memory/2324-51-0x0000000004B60000-0x0000000004EAE000-memory.dmp	family_darkgate_v6
behavioral5/memory/2324-53-0x0000000004B60000-0x0000000004EAE000-memory.dmp	family_darkgate_v6
behavioral5/memory/2044-69-0x0000000004C30000-0x0000000004F7E000-memory.dmp	family_darkgate_v6
behavioral5/memory/2044-68-0x00000000037B0000-0x0000000004780000-memory.dmp	family_darkgate_v6
behavioral5/memory/2044-70-0x0000000004C30000-0x0000000004F7E000-memory.dmp	family_darkgate_v6

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Executes dropped EXE 4 IoCs

pid	Process
2376	Autoit3.exe
2492	Autoit3.exe
2324	Autoit3.exe
2044	Autoit3.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2376	1664	vlc.exe	28
PID 1664 wrote to memory of 2376	1664	vlc.exe	28
PID 1664 wrote to memory of 2376	1664	vlc.exe	28
PID 1664 wrote to memory of 2376	1664	vlc.exe	28
PID 2716 wrote to memory of 2444	2716	cmd.exe	33
PID 2716 wrote to memory of 2444	2716	cmd.exe	33
PID 2716 wrote to memory of 2444	2716	cmd.exe	33
PID 2444 wrote to memory of 2492	2444	vlc.exe	34
PID 2444 wrote to memory of 2492	2444	vlc.exe	34
PID 2444 wrote to memory of 2492	2444	vlc.exe	34
PID 2444 wrote to memory of 2492	2444	vlc.exe	34
PID 2716 wrote to memory of 2228	2716	cmd.exe	35
PID 2716 wrote to memory of 2228	2716	cmd.exe	35
PID 2716 wrote to memory of 2228	2716	cmd.exe	35
PID 2228 wrote to memory of 2324	2228	vlc.exe	36
PID 2228 wrote to memory of 2324	2228	vlc.exe	36
PID 2228 wrote to memory of 2324	2228	vlc.exe	36
PID 2228 wrote to memory of 2324	2228	vlc.exe	36
PID 2716 wrote to memory of 2912	2716	cmd.exe	37
PID 2716 wrote to memory of 2912	2716	cmd.exe	37
PID 2716 wrote to memory of 2912	2716	cmd.exe	37
PID 2912 wrote to memory of 2044	2912	vlc.exe	38
PID 2912 wrote to memory of 2044	2912	vlc.exe	38
PID 2912 wrote to memory of 2044	2912	vlc.exe	38
PID 2912 wrote to memory of 2044	2912	vlc.exe	38

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- \??\c:\temp\Autoit3.exe
  "c:\temp\Autoit3.exe" c:\temp\script.au3
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2376

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- \??\c:\Users\Admin\AppData\Local\Temp\vlc.exe
  vlc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - \??\c:\temp\Autoit3.exe
    "c:\temp\Autoit3.exe" c:\temp\script.au3
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:2492
- \??\c:\Users\Admin\AppData\Local\Temp\vlc.exe
  vlc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - \??\c:\temp\Autoit3.exe
    "c:\temp\Autoit3.exe" c:\temp\script.au3
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:2324
- \??\c:\Users\Admin\AppData\Local\Temp\vlc.exe
  vlc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - \??\c:\temp\Autoit3.exe
    "c:\temp\Autoit3.exe" c:\temp\script.au3
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\hgfdehh\fggedfb

Filesize
363B

MD5
ecd9274d56ccf18101144ace9d1744bd

SHA1
9ed04425ed1fb0851f6238fa680a13d4df7193a4

SHA256
9f43b6c04ee73e62bb91e1e16103ec1ea6df589d0eb1582c1da780be1ebae149

SHA512
58555d6057141b34572035d24614d5b70a60b651c9cc68e23d351009f6308f1b6bc55b5c00bbb9a5c2edcaf1ed8b28787f7a18707bd870bce947e4f900ab0340

Download Submit
C:\Users\Admin\AppData\Roaming\dfHaBeb

Filesize
32B

MD5
8917dba1c155b3093fd94cd0d415b319

SHA1
ac796f6c167672869d7574df3efaf12d0852ffec

SHA256
f1280b02b9c456132d2f69eca688b7b83607a159341a25119cdf859cfce62b54

SHA512
9d6f40b3a0d60e8d47772d8df3f8198421d8618fc9f68226c9a53274f828493fcc6eb51c82a79f1ccb310583aa2ba2f1b86dfd2a43edfb7931bcb7607cbb8b57

Download Submit
C:\temp\Autoit3.exe

Filesize
69KB

MD5
b3df76f717111eb995dc9ebf8217ba95

SHA1
7b4fe6128fe4519bf0f04ea3e75247fbfd318049

SHA256
f7644ac1e3f88acd0275fb46644e4a3eaedf99b947bded7396f6696603b0a060

SHA512
fbfab1886afe7879580c17469f74ab53ae95fd0b23c5a5293fdb5126c5863057937f83c8986c8eaa51c6cdfb48a2248694967fd2691fd93c0f31fba9c320eb18

Download Submit
C:\temp\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\temp\script.au3

Filesize
469KB

MD5
e1803b01e3f187355dbeb87a0c91b76c

SHA1
b78bc11afacf9cfcaade0e200a344c4602f2053d

SHA256
46c5ed90e3d6b8bc85ae369aa87ba75a12eed6a7cfa8edeb497e5ec7f7c75d9e

SHA512
bfcc8cf7c72bcbf2aa2586a653df00e5c0e7fccb748a5fcdf97ebfaa594fbf81e1c24ce1f5ced039dea76bf251a76ec85db2187614039fa882d702bdc14c6bda

Download Submit
\??\c:\temp\test.txt

Filesize
76B

MD5
6f142d573154e352f3787270e5adc50a

SHA1
9dd1b5353225ff98b9a6d5a58a20d5bf6757fa90

SHA256
32133d31a507047ae10993a7f9634e3613d8b894fd07315db266d82dd40976f9

SHA512
5a72458d310f4c1ab1e6a7a6c2ae41ab4debe02b3eeadce73ee26dd64ce25e7044fef20d1aa4716a5212fcdd9bd01c52a6b0df67fcd6c052aff84bd7ee954237

Download Submit
memory/1664-8-0x00000000745D0000-0x000000007475D000-memory.dmp

Filesize
1.6MB

Download
memory/1664-7-0x000000013F0D0000-0x000000013F1C8000-memory.dmp

Filesize
992KB

Download
memory/1664-10-0x0000000002100000-0x000000000229E000-memory.dmp

Filesize
1.6MB

Download
memory/1664-0-0x0000000002100000-0x000000000229E000-memory.dmp

Filesize
1.6MB

Download
memory/2044-68-0x00000000037B0000-0x0000000004780000-memory.dmp

Filesize
15.8MB

Download
memory/2044-69-0x0000000004C30000-0x0000000004F7E000-memory.dmp

Filesize
3.3MB

Download
memory/2044-70-0x0000000004C30000-0x0000000004F7E000-memory.dmp

Filesize
3.3MB

Download
memory/2228-44-0x000000013F060000-0x000000013F158000-memory.dmp

Filesize
992KB

Download
memory/2228-36-0x00000000021A0000-0x000000000233E000-memory.dmp

Filesize
1.6MB

Download
memory/2228-49-0x00000000021A0000-0x000000000233E000-memory.dmp

Filesize
1.6MB

Download
memory/2228-46-0x00000000741B0000-0x000000007433D000-memory.dmp

Filesize
1.6MB

Download
memory/2324-53-0x0000000004B60000-0x0000000004EAE000-memory.dmp

Filesize
3.3MB

Download
memory/2324-50-0x00000000036E0000-0x00000000046B0000-memory.dmp

Filesize
15.8MB

Download
memory/2324-51-0x0000000004B60000-0x0000000004EAE000-memory.dmp

Filesize
3.3MB

Download
memory/2376-13-0x0000000003790000-0x0000000004760000-memory.dmp

Filesize
15.8MB

Download
memory/2376-14-0x0000000004C10000-0x0000000004F5E000-memory.dmp

Filesize
3.3MB

Download
memory/2376-16-0x0000000004C10000-0x0000000004F5E000-memory.dmp

Filesize
3.3MB

Download
memory/2444-17-0x0000000002150000-0x00000000022EE000-memory.dmp

Filesize
1.6MB

Download
memory/2444-25-0x000000013F150000-0x000000013F248000-memory.dmp

Filesize
992KB

Download
memory/2444-26-0x0000000074340000-0x00000000744CD000-memory.dmp

Filesize
1.6MB

Download
memory/2444-28-0x0000000002150000-0x00000000022EE000-memory.dmp

Filesize
1.6MB

Download
memory/2492-32-0x0000000004B90000-0x0000000004EDE000-memory.dmp

Filesize
3.3MB

Download
memory/2492-31-0x0000000003710000-0x00000000046E0000-memory.dmp

Filesize
15.8MB

Download
memory/2492-35-0x0000000004B90000-0x0000000004EDE000-memory.dmp

Filesize
3.3MB

Download
memory/2912-57-0x0000000002130000-0x00000000022CE000-memory.dmp

Filesize
1.6MB

Download
memory/2912-63-0x0000000074340000-0x00000000744CD000-memory.dmp

Filesize
1.6MB

Download
memory/2912-62-0x000000013F9C0000-0x000000013FAB8000-memory.dmp

Filesize
992KB

Download
memory/2912-65-0x0000000002130000-0x00000000022CE000-memory.dmp

Filesize
1.6MB

Download

Resubmissions

Analysis

Sharing