darkgate | 27c1008f283ea779e96e487038c4f0a34c355439cb97790998df4a178baaa433

Resubmissions

20-03-2024 13:26

240320-qpv4asac21 10

19-03-2024 15:20

240319-sq7vlafb95 10

Analysis

max time kernel
359s
max time network
364s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vlc.exe
Size

966KB
MD5

035860e139ba6db1b38d5346cb6ff5b6
SHA1

d515303cbca3a8ae7a0463fecd418d81b314e650
SHA256

16197a321fc7b0a2a311e689621fe4a7cd50fdcb2d163973a31e4fd6352232d7
SHA512

14dab9108d85af72001631130923b94483dd1440f24a8eedad41756db3030c5e11e80ec894922c389e09c86e8b721bcbd8594bd3646f484560f89963a7e18cc7
SSDEEP

24576:le3xAibB85Z1HrWtB8z1L1OQJK5zzz3zzzozzz3zzz2w:wxAibBEZ1LWtBznvw

Score

10^/10

darkgate admin888 stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

newdomainfortesteenestle.com

Attributes

anti_analysis
true
anti_debug
false
anti_vm
false
c2_port
443
check_disk
false
check_ram
true
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
ZLhPAWah
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
false
username
admin888

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

resource	yara_rule
behavioral5/memory/2200-14-0x0000000003640000-0x0000000004610000-memory.dmp	family_darkgate_v6
behavioral5/memory/2200-15-0x0000000004AC0000-0x0000000004E0E000-memory.dmp	family_darkgate_v6

Executes dropped EXE 1 IoCs

pid	Process
2200	Autoit3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2200	2924	vlc.exe	28
PID 2924 wrote to memory of 2200	2924	vlc.exe	28
PID 2924 wrote to memory of 2200	2924	vlc.exe	28
PID 2924 wrote to memory of 2200	2924	vlc.exe	28

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- \??\c:\temp\Autoit3.exe
  "c:\temp\Autoit3.exe" c:\temp\script.au3
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\temp\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\temp\script.au3

Filesize
469KB

MD5
e1803b01e3f187355dbeb87a0c91b76c

SHA1
b78bc11afacf9cfcaade0e200a344c4602f2053d

SHA256
46c5ed90e3d6b8bc85ae369aa87ba75a12eed6a7cfa8edeb497e5ec7f7c75d9e

SHA512
bfcc8cf7c72bcbf2aa2586a653df00e5c0e7fccb748a5fcdf97ebfaa594fbf81e1c24ce1f5ced039dea76bf251a76ec85db2187614039fa882d702bdc14c6bda

Download Submit
\??\c:\temp\test.txt

Filesize
76B

MD5
6f142d573154e352f3787270e5adc50a

SHA1
9dd1b5353225ff98b9a6d5a58a20d5bf6757fa90

SHA256
32133d31a507047ae10993a7f9634e3613d8b894fd07315db266d82dd40976f9

SHA512
5a72458d310f4c1ab1e6a7a6c2ae41ab4debe02b3eeadce73ee26dd64ce25e7044fef20d1aa4716a5212fcdd9bd01c52a6b0df67fcd6c052aff84bd7ee954237

Download Submit
memory/2200-14-0x0000000003640000-0x0000000004610000-memory.dmp

Filesize
15.8MB

Download
memory/2200-15-0x0000000004AC0000-0x0000000004E0E000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2-0x0000000002200000-0x000000000239E000-memory.dmp

Filesize
1.6MB

Download
memory/2924-7-0x000000013F6F0000-0x000000013F7E8000-memory.dmp

Filesize
992KB

Download
memory/2924-8-0x0000000075460000-0x00000000755ED000-memory.dmp

Filesize
1.6MB

Download
memory/2924-11-0x0000000002200000-0x000000000239E000-memory.dmp

Filesize
1.6MB

Download