Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2024 09:44

General

  • Target

    exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe

  • Size

    434KB

  • MD5

    32779bb4eda0b1834dc50d88f4930c3e

  • SHA1

    7041fb14c8593d2657d4244d6930a35a2745f96e

  • SHA256

    8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7

  • SHA512

    aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8

  • SSDEEP

    12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro

Malware Config

Extracted

Family

darkgate

Version



C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    true

  • crypto_key

    LAbQdWWsbybjAY

  • internal_mutex

    bbcAde

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    10

  • rootkit

    false

  • startup_persistence

    false

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 11 IoCs
  • Blocklisted process makes network request 12 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe
    "C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:1952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\khahfdb\dkaffag\heehbdc

    Filesize

    180B

    MD5

    8c960b6cb752f5f1bb6f34d4fd2bf3b3

    SHA1

    09529adcf264833e275a183136977ec30c8029ee

    SHA256

    1c38b0a3f7589ebfec7653baf6b445a2124c18bd5a0384f4d076ea0d306be29e

    SHA512

    17ef02556fd16dd2b570805e71bf08aef9f04d7276fec25615e63fd274c7e8825914510da9afbee5a702a632bc92d2aff24e031d2cf64120a641b50676772269

  • C:\Users\Admin\AppData\Local\Temp\dfdkbec

    Filesize

    132B

    MD5

    66878ee2eee64e53e519fad44fa644dc

    SHA1

    560a0a0e592d86a7b8651d8f0d7dac3d28a3a8f9

    SHA256

    51be232d4ccea4d1c5df80c205bacae353df925606a20f3789fe1b63cca4a0bd

    SHA512

    21244eaca0421503676b7829ba336d0a9d3370ea66f92fd3e879170ae9640661b8be45d108794ad21565ea58d7f48b91b4ed16a378858a5d285136e6649b61c6

  • memory/1952-6-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-2-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-4-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-5-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-12-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-10-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-11-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-14-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-13-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1952-15-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2464-3-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB