Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21-08-2024 20:17

General

  • Target

    pidgin.exe

  • Size

    108KB

  • MD5

    c283b2379ea584aab52abee0844b02a0

  • SHA1

    903f9c7dcadf578637d604be681588fffec90e9b

  • SHA256

    8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

  • SHA512

    a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

  • SSDEEP

    1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm

Malware Config

Extracted

Family

darkgate

Version

uPtZ

C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    true

  • crypter_raw_stub

    false

  • crypto_key

    qwNPPzrRTNHogf

  • internal_mutex

    hykYbY

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    1

  • rootkit

    false

  • startup_persistence

    true

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 12 IoCs
  • Blocklisted process makes network request 50 IoCs
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pidgin.exe
    "C:\Users\Admin\AppData\Local\Temp\pidgin.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\fabhadh\hefhagg\fbkhabb

    Filesize

    163B

    MD5

    4ce25878e7c323fb679ea1c4893fffde

    SHA1

    ce9cc880f262ed9093c1b72ede64cc2d427126f1

    SHA256

    8cd68a89c9f9d88912f38ae41ba64311eb042228e47ec4857d80659f62af146c

    SHA512

    fcc54f22ac8678a41c8ddba0f2fb72679c0cee3f2996c06f5974529da80b5db68875def63be4cf52c6ef44065e1eb9cecbf2955cf0cb109b62ff488b3b9775c2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ekccchc.lnk

    Filesize

    782B

    MD5

    1bff14d073c57d4eea2e69c56b4211f6

    SHA1

    ffb44abb91d62ec7922424db6bd46f14417f45cf

    SHA256

    b4a7b5efc389980aa8bec173706762b714431053d4552c0e891006b6fbf4aa1e

    SHA512

    908188c11a378d45d3f2f2e83e27ec2f6d2b8aa308bf00c63e3fd93cd0234f4baf64433ef2fec6e990ee37407e6acc8d44075df7c1152f17e5b9aeb09f50800d

  • C:\temp\libssp-0.dll

    Filesize

    88KB

    MD5

    1f521e8b258d2b09f66fb8c940452b72

    SHA1

    7d669fe4108d40ed431a6728a27a2efc5c153bd0

    SHA256

    7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462

    SHA512

    61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3

  • C:\temp\pidgin.exe

    Filesize

    108KB

    MD5

    c283b2379ea584aab52abee0844b02a0

    SHA1

    903f9c7dcadf578637d604be681588fffec90e9b

    SHA256

    8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

    SHA512

    a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

  • C:\temp\sqlite3.dll

    Filesize

    488KB

    MD5

    05ec7e9dee5c43b659d7843f6eb462a2

    SHA1

    1d37a930765e282b75b1d129258e21f683379245

    SHA256

    b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4

    SHA512

    fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6

  • memory/1976-11-0x0000000000710000-0x0000000000805000-memory.dmp

    Filesize

    980KB

  • memory/1976-12-0x0000000000CB0000-0x0000000000EA0000-memory.dmp

    Filesize

    1.9MB

  • memory/1976-39-0x0000000000CB0000-0x0000000000EA0000-memory.dmp

    Filesize

    1.9MB

  • memory/1976-8-0x0000000000020000-0x000000000003B000-memory.dmp

    Filesize

    108KB

  • memory/1976-7-0x0000000000F60000-0x0000000000F7C000-memory.dmp

    Filesize

    112KB

  • memory/1976-0-0x0000000000020000-0x000000000003B000-memory.dmp

    Filesize

    108KB

  • memory/3024-17-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-6-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-28-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-31-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-33-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-30-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-29-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-35-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-9-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-10-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/3024-42-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB