Overview
overview
10Static
static
10apk/cyberR...ws.jar
windows7-x64
1apk/cyberR...ws.jar
windows10-2004-x64
1apk/cyberR...x.html
windows7-x64
3apk/cyberR...x.html
windows10-2004-x64
3apk/cyberR...x.html
windows7-x64
3apk/cyberR...x.html
windows10-2004-x64
3exe/crypte...te.bat
windows7-x64
10exe/crypte...te.bat
windows10-2004-x64
10exe/crypte...er.vbs
windows7-x64
10exe/crypte...er.vbs
windows10-2004-x64
10exe/crypte...-0.dll
windows7-x64
1exe/crypte...-0.dll
windows10-2004-x64
1exe/crypte...e3.exe
windows7-x64
3exe/crypte...e3.exe
windows10-2004-x64
3exe/crypte...-0.dll
windows7-x64
3exe/crypte...-0.dll
windows10-2004-x64
3exe/crypte...in.exe
windows7-x64
10exe/crypte...in.exe
windows10-2004-x64
10exe/crypte...e3.dll
windows7-x64
1exe/crypte...e3.dll
windows10-2004-x64
1libssp-0.dll
windows7-x64
3libssp-0.dll
windows10-2004-x64
3pidgin.exe
windows7-x64
10pidgin.exe
windows10-2004-x64
10sqlite3.dll
windows7-x64
1sqlite3.dll
windows10-2004-x64
1exe/non cr...x.html
windows7-x64
3exe/non cr...x.html
windows10-2004-x64
3exe/non cr...ed.exe
windows7-x64
10exe/non cr...ed.exe
windows10-2004-x64
10exe/non cr...x.html
windows7-x64
3exe/non cr...x.html
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2024 01:40
Behavioral task
behavioral1
Sample
apk/cyberRat/Port 7262 sample build/Google News.jar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
apk/cyberRat/Port 7262 sample build/Google News.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
apk/cyberRat/Port 7262 sample build/index.html
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
apk/cyberRat/Port 7262 sample build/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
apk/cyberRat/index.html
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
apk/cyberRat/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/Batch file for 5864v dll crypted darkgate/update.bat
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/Batch file for 5864v dll crypted darkgate/update.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/launcher.vbs
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/launcher.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/sqlite3.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/sqlite3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/libssp-0.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/libssp-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/sqlite3.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/sqlite3.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
libssp-0.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
libssp-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
pidgin.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
pidgin.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
sqlite3.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
sqlite3.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
exe/non crypted/Darkgate 5864 port sample not startup/index.html
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
exe/non crypted/Darkgate 5864 port sample not startup/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
exe/non crypted/index.html
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
exe/non crypted/index.html
Resource
win10v2004-20240802-en
General
-
Target
exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe
-
Size
434KB
-
MD5
32779bb4eda0b1834dc50d88f4930c3e
-
SHA1
7041fb14c8593d2657d4244d6930a35a2745f96e
-
SHA256
8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7
-
SHA512
aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8
-
SSDEEP
12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro
Malware Config
Extracted
darkgate
http://sanibroadbandcommunicton.duckdns.org
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
5864
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
true
-
crypto_key
LAbQdWWsbybjAY
-
internal_mutex
bbcAde
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
10
-
rootkit
false
-
startup_persistence
false
Signatures
-
Detect DarkGate stealer 11 IoCs
resource yara_rule behavioral30/memory/1020-2-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-4-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/2340-3-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-5-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-6-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-10-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-13-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-12-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-14-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-11-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 behavioral30/memory/1020-15-0x0000000000400000-0x0000000000473000-memory.dmp family_darkgate_v6 -
Blocklisted process makes network request 12 IoCs
flow pid Process 27 1020 cmd.exe 28 1020 cmd.exe 37 1020 cmd.exe 49 1020 cmd.exe 54 1020 cmd.exe 55 1020 cmd.exe 63 1020 cmd.exe 70 1020 cmd.exe 73 1020 cmd.exe 86 1020 cmd.exe 89 1020 cmd.exe 92 1020 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2340 set thread context of 1020 2340 stubbed.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stubbed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cmd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString cmd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stubbed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stubbed.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2340 stubbed.exe 2340 stubbed.exe 1020 cmd.exe 1020 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2340 wrote to memory of 3824 2340 stubbed.exe 89 PID 2340 wrote to memory of 3824 2340 stubbed.exe 89 PID 2340 wrote to memory of 3824 2340 stubbed.exe 89 PID 2340 wrote to memory of 1020 2340 stubbed.exe 90 PID 2340 wrote to memory of 1020 2340 stubbed.exe 90 PID 2340 wrote to memory of 1020 2340 stubbed.exe 90 PID 2340 wrote to memory of 1020 2340 stubbed.exe 90 PID 2340 wrote to memory of 1020 2340 stubbed.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe"C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:3824
-
-
C:\Windows\SysWOW64\cmd.execmd.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180B
MD5578fa5b233cb24b0bcfd2025d208f606
SHA12967679de1fba0f5a1c1413945aefcadcb6cf4ea
SHA25659f4422792d5f00c0ba5640f087043f5d3218bfadd6fc8fd5601857e3458f3bb
SHA5129f0f64a5d944f4a2a4d34c6c2e58fd5ae62f319d78bc40e04251a07f1ce8d65d7c944835cd880779de15954845414150412c3527a89facc4f476beca85119ad4
-
Filesize
132B
MD566878ee2eee64e53e519fad44fa644dc
SHA1560a0a0e592d86a7b8651d8f0d7dac3d28a3a8f9
SHA25651be232d4ccea4d1c5df80c205bacae353df925606a20f3789fe1b63cca4a0bd
SHA51221244eaca0421503676b7829ba336d0a9d3370ea66f92fd3e879170ae9640661b8be45d108794ad21565ea58d7f48b91b4ed16a378858a5d285136e6649b61c6