Analysis
- max time kernel
615s - max time network
873s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
23/04/2024, 17:49
General
- Target abc.exe
- Size 39KB
- Sample240423-weabqsad2s
- SHA256 796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
Score
10/10
Malware Config
Extracted
Family
-
darkgate
Botnet
-
kaitoshiba123
C2
-
45.63.52.184
Attributes
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
8094
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
EhuJByqk
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
kaitoshiba123
Signatures
- DarkGate
DarkGate is an infostealer written in C++.
- Detect DarkGate stealer 2 IoCs
- Executes dropped EXE 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\abc.exe"C:\Users\Admin\AppData\Local\Temp\abc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\st\Autoit3.exe"c:\st\Autoit3.exe" c:\st\script.a3x2⤵
- Executes dropped EXE
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Autoit3.exe
script.a3x
test.txt
memory/2356-11-0x00000000043E0000-0x00000000053B0000-memory.dmp
memory/2356-12-0x00000000058F0000-0x0000000005C7A000-memory.dmp
memory/2356-13-0x00000000058F0000-0x0000000005C7A000-memory.dmp
memory/3532-0-0x0000000002670000-0x00000000027D7000-memory.dmp
memory/3532-6-0x0000000002670000-0x00000000027D7000-memory.dmp