Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 20:17

General

  • Target

    exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe

  • Size

    434KB

  • MD5

    32779bb4eda0b1834dc50d88f4930c3e

  • SHA1

    7041fb14c8593d2657d4244d6930a35a2745f96e

  • SHA256

    8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7

  • SHA512

    aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8

  • SSDEEP

    12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro

Malware Config

Extracted

Family

darkgate

Version



C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    true

  • crypto_key

    LAbQdWWsbybjAY

  • internal_mutex

    bbcAde

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    10

  • rootkit

    false

  • startup_persistence

    false

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 11 IoCs
  • Blocklisted process makes network request 12 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe
    "C:\Users\Admin\AppData\Local\Temp\exe\non crypted\Darkgate 5864 port sample not startup\stubbed.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\dchfefh\caddech\abbchgc

    Filesize

    180B

    MD5

    a10a09a80b2f3ef27f0a5d4abbc2a06c

    SHA1

    c027583c6d51d0f295506c0a48d26c82fc56846e

    SHA256

    a9a0e501eb87503c8ad2573752e58982887d460321ff13801bd08f9705ba8491

    SHA512

    906470ef424f45f1d9e3a8ae9f6b7e344cfbc350a2195b7a1a4e36f4787b5af5b618445de858bd41af4dd6682e8cfe29357496c3230b638bf5c74e64c36cb7b2

  • C:\Users\Admin\AppData\Local\Temp\fbdgdce

    Filesize

    132B

    MD5

    66878ee2eee64e53e519fad44fa644dc

    SHA1

    560a0a0e592d86a7b8651d8f0d7dac3d28a3a8f9

    SHA256

    51be232d4ccea4d1c5df80c205bacae353df925606a20f3789fe1b63cca4a0bd

    SHA512

    21244eaca0421503676b7829ba336d0a9d3370ea66f92fd3e879170ae9640661b8be45d108794ad21565ea58d7f48b91b4ed16a378858a5d285136e6649b61c6

  • memory/4580-5-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-2-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-4-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-6-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-13-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-14-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-12-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-10-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-11-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4580-15-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4636-3-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB