Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2024 01:51

General

  • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe

  • Size

    108KB

  • MD5

    c283b2379ea584aab52abee0844b02a0

  • SHA1

    903f9c7dcadf578637d604be681588fffec90e9b

  • SHA256

    8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

  • SHA512

    a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

  • SSDEEP

    1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm

Malware Config

Extracted

Family

darkgate

Version

uPtZ

C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    true

  • crypter_raw_stub

    false

  • crypto_key

    qwNPPzrRTNHogf

  • internal_mutex

    hykYbY

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    1

  • rootkit

    false

  • startup_persistence

    true

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 14 IoCs
  • Blocklisted process makes network request 36 IoCs
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe\crypted\Dakrgate 5864 startup plus rootkit\protected_AU3_cGig\pidgin.exe
    "C:\Users\Admin\AppData\Local\Temp\exe\crypted\Dakrgate 5864 startup plus rootkit\protected_AU3_cGig\pidgin.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:4396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\dbedakd\cbdchca\fhdfakf

    Filesize

    163B

    MD5

    73e1115b30b4a1b0eb599f301709fad2

    SHA1

    27a3026e6afaa6317060119a69a02d2296d6df03

    SHA256

    e3ead2c8753ea1a7f5a9e4b9b2d2eab0ded5d5476552f06181f2134a2dbcd040

    SHA512

    cb1ceec043fc66725aeef613c9d62139a127df7068dac1c3dd0a02f8e9956d92e9e80debe71e5af9f736b6dbcd9ac629e9d53dbb34d2fc1d4375ebb67ed078b6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fffddke.lnk

    Filesize

    823B

    MD5

    6ddf300cb4e4c013c3a490e744f88830

    SHA1

    b022b4ff07f3568f7a8750a80d3a1b6916203a8b

    SHA256

    a9094cf492137563f8fbc555a2cf818c3f3bfa1717c9dabe1ab7578807b7998c

    SHA512

    a7f0a4c56fe311534d53f1acc35691d38a91e0277faef978e7cac5568033315ef46786ddb3ed01b831786a30b14135825767c1c57b7ba1d01bc76e86907ab262

  • C:\temp\libssp-0.dll

    Filesize

    88KB

    MD5

    1f521e8b258d2b09f66fb8c940452b72

    SHA1

    7d669fe4108d40ed431a6728a27a2efc5c153bd0

    SHA256

    7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462

    SHA512

    61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3

  • C:\temp\pidgin.exe

    Filesize

    108KB

    MD5

    c283b2379ea584aab52abee0844b02a0

    SHA1

    903f9c7dcadf578637d604be681588fffec90e9b

    SHA256

    8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

    SHA512

    a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

  • C:\temp\sqlite3.dll

    Filesize

    488KB

    MD5

    05ec7e9dee5c43b659d7843f6eb462a2

    SHA1

    1d37a930765e282b75b1d129258e21f683379245

    SHA256

    b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4

    SHA512

    fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6

  • memory/1936-1-0x00000000037B0000-0x00000000038A5000-memory.dmp

    Filesize

    980KB

  • memory/1936-9-0x0000000000EC0000-0x0000000000EDC000-memory.dmp

    Filesize

    112KB

  • memory/1936-0-0x00000000034C0000-0x00000000036B0000-memory.dmp

    Filesize

    1.9MB

  • memory/1936-10-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1936-12-0x00000000037B0000-0x00000000038A5000-memory.dmp

    Filesize

    980KB

  • memory/4396-11-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-7-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-8-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-29-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-28-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-32-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-31-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-26-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-27-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-34-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-6-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/4396-38-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB