Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21-08-2024 20:17

General

  • Target

    exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe

  • Size

    434KB

  • MD5

    32779bb4eda0b1834dc50d88f4930c3e

  • SHA1

    7041fb14c8593d2657d4244d6930a35a2745f96e

  • SHA256

    8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7

  • SHA512

    aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8

  • SSDEEP

    12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro

Malware Config

Extracted

Family

darkgate

Version



C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    true

  • crypto_key

    LAbQdWWsbybjAY

  • internal_mutex

    bbcAde

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    10

  • rootkit

    false

  • startup_persistence

    false

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 11 IoCs
  • Blocklisted process makes network request 13 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe
    "C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
        PID:2348
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe
        2⤵
          PID:1788
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe
          2⤵
          • Blocklisted process makes network request
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2184

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\bchhcdf\dahddeg\hchfehd

        Filesize

        180B

        MD5

        44f3a6083c236441ada91904241e2adb

        SHA1

        cf06e4004a35134793043b46197a9d4e9f444af1

        SHA256

        53cfc1c2888f34635b5f282498fd3e89ebbb9ef83b0dc70b2346c2f40722d358

        SHA512

        0310e7db9a9efb2927c1c94900145a0db05ee7e3e3d5548655f0670a434149022d7cfb437b40ce6d704515ab15f1ce4dafc574b1413cff4716ff571105a5318d

      • C:\Users\Admin\AppData\Local\Temp\ebcddfh

        Filesize

        132B

        MD5

        66878ee2eee64e53e519fad44fa644dc

        SHA1

        560a0a0e592d86a7b8651d8f0d7dac3d28a3a8f9

        SHA256

        51be232d4ccea4d1c5df80c205bacae353df925606a20f3789fe1b63cca4a0bd

        SHA512

        21244eaca0421503676b7829ba336d0a9d3370ea66f92fd3e879170ae9640661b8be45d108794ad21565ea58d7f48b91b4ed16a378858a5d285136e6649b61c6

      • memory/1960-5-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-8-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-2-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2184-7-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-6-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-12-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-14-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-13-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-15-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-16-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB

      • memory/2184-17-0x0000000000400000-0x0000000000473000-memory.dmp

        Filesize

        460KB