Analysis
-
max time kernel
139s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
02-05-2024 16:00
General
-
Target
darkgate_xor_payload.exe
-
Size
461KB
-
MD5
2a324cba9f874bfd6a567848d9bb6127
-
SHA1
8117ec04dd2e5f773dcdb3253835365b6ec3df9b
-
SHA256
eb64f5c3dc9df31f9a18f736763235703e6c09564f8176889191bb55d2c28198
-
SHA512
90812cc05411bd592df0b5746b178827a7a7139ab6559a3971fadf6ca30af9fab83c63c5d274ddd941d8b616b6c12942e8f996b31132f8c4488b224467dce7a4
-
SSDEEP
12288:VqilipcPNrKEj2R1zNAYFWtInQnqnVrb:VhljPNrKEjezNAYFQGC2
Score
10/10
Malware Config
Extracted
Family
darkgate
Botnet
admin888
C2
dogmupdate.com
Attributes
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
SFZFQODn
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
-
DarkGate
DarkGate is an infostealer written in C++.
-
Detect DarkGate stealer 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\darkgate_xor_payload.exe"C:\Users\Admin\AppData\Local\Temp\darkgate_xor_payload.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460KB