Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2024 09:44

General

  • Target

    exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe

  • Size

    434KB

  • MD5

    32779bb4eda0b1834dc50d88f4930c3e

  • SHA1

    7041fb14c8593d2657d4244d6930a35a2745f96e

  • SHA256

    8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7

  • SHA512

    aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8

  • SSDEEP

    12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro

Malware Config

Extracted

Family

darkgate

Version



C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    true

  • crypto_key

    LAbQdWWsbybjAY

  • internal_mutex

    bbcAde

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    10

  • rootkit

    false

  • startup_persistence

    false

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 11 IoCs
  • Blocklisted process makes network request 13 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe
    "C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:1600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\dbbehfh\hacacfc\bebbfah

    Filesize

    180B

    MD5

    25e800e6dfdb45d9953c889feb330e24

    SHA1

    6c4f17cabd3237902327353c69648584ca2973c9

    SHA256

    60b0fa443acdba293bdb7ef79e9045686eccf89610096d66353dfa185cfa7d9b

    SHA512

    b630a3610e399e89759367c53d1fb7b4cedaecf5c9689a8c8849051c8c69954ad4bdc21f932c5939a960863a54fc4f13c604997ce7ed80a6aef006324d0827d2

  • C:\Users\Admin\AppData\Local\Temp\bbdkfdk

    Filesize

    132B

    MD5

    66878ee2eee64e53e519fad44fa644dc

    SHA1

    560a0a0e592d86a7b8651d8f0d7dac3d28a3a8f9

    SHA256

    51be232d4ccea4d1c5df80c205bacae353df925606a20f3789fe1b63cca4a0bd

    SHA512

    21244eaca0421503676b7829ba336d0a9d3370ea66f92fd3e879170ae9640661b8be45d108794ad21565ea58d7f48b91b4ed16a378858a5d285136e6649b61c6

  • memory/1176-5-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-6-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-2-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-3-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-4-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-12-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-11-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-10-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-14-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-13-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1600-15-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB