darkgate | 38c2831d236cca17e7a907073eb60c718ca0ab35cbaf71bc63bf8d45b74deb2b

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
Size

405KB
MD5

52fc04a1017bff949d2531942491e7d9
SHA1

0f23ac4f5dc0603894374026349d7db0f870ee91
SHA256

c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229
SHA512

920905dc5d7c25daf2ba38daeeeab8ffe883023905ecb166f585346b012caeb3629e12400ca0df4c24e23d2abdea8081f7272d3b1385121ffc301f2982a10c85
SSDEEP

12288:0UEpOEWzuYzy/Bda9AlxhwcySTcth/4N:0fOEWjyZda9uhwlSIf4

Score

10^/10

darkgate civilian1337 stealer

Malware Config

Extracted

Family

darkgate

Version

5.2.4

Botnet

civilian1337

http://185.130.227.202

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
true
anti_vm
false
c2_port
2351
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
VPsTDMdPronzYs
internal_mutex
txtMut
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
civilian1337

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 4 IoCs

resource	yara_rule
behavioral2/memory/5096-3-0x0000000000400000-0x0000000000465000-memory.dmp	family_darkgate_v6
behavioral2/memory/5096-4-0x0000000000400000-0x0000000000465000-memory.dmp	family_darkgate_v6
behavioral2/memory/5096-5-0x0000000000400000-0x0000000000465000-memory.dmp	family_darkgate_v6
behavioral2/memory/5096-7-0x0000000000400000-0x0000000000465000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 5096 created 4000	5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe	60
PID 5096 created 2684	5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe	45
PID 5096 created 2684	5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe	45
PID 5096 created 2652	5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe	44
PID 5096 created 2652	5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe	44

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
5096	c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2684

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe
"C:\Users\Admin\AppData\Local\Temp\c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5096-3-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/5096-4-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/5096-5-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/5096-7-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download