Resubmissions

25-08-2024 09:52

240825-lwb7jsxgmh 10

22-08-2024 07:27

240822-h98wwsvdrh 10

22-08-2024 07:21

240822-h651tsxhrk 10

21-08-2024 20:21

240821-y44b8aydje 10

Analysis

  • max time kernel
    103s
  • max time network
    106s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-08-2024 20:21

General

  • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe

  • Size

    108KB

  • MD5

    c283b2379ea584aab52abee0844b02a0

  • SHA1

    903f9c7dcadf578637d604be681588fffec90e9b

  • SHA256

    8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

  • SHA512

    a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

  • SSDEEP

    1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm

Malware Config

Extracted

Family

darkgate

Version

uPtZ

C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    true

  • crypter_raw_stub

    false

  • crypto_key

    qwNPPzrRTNHogf

  • internal_mutex

    hykYbY

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    1

  • rootkit

    false

  • startup_persistence

    true

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 14 IoCs
  • Blocklisted process makes network request 35 IoCs
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe\crypted\Dakrgate 5864 startup plus rootkit\protected_AU3_cGig\pidgin.exe
    "C:\Users\Admin\AppData\Local\Temp\exe\crypted\Dakrgate 5864 startup plus rootkit\protected_AU3_cGig\pidgin.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
        PID:3424
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe
        2⤵
        • Blocklisted process makes network request
        • Drops startup file
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        PID:4528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\ehehbgd\dccckcc\fdccbbf

      Filesize

      163B

      MD5

      170c0d945da59e822d836e219e2d9408

      SHA1

      cb392c685a251cd9b0510fac40344c1231ac478a

      SHA256

      e16c305a0ddb74b397320166c72b9ae9874abacdfff53cdf7298c94176c33126

      SHA512

      9b3abbc81627e21fbbba1b7237356bd75c7474607845c60814792ca1d0329448227439b35cc7111d2acdd33a918df2ca93b225235f7ef9e0394b71e621902566

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hhhcbce.lnk

      Filesize

      823B

      MD5

      99fb65b4fdcbc3ed04c4b2bff1094719

      SHA1

      e6aa6f701f58e4f9ab2b83f32ab033646ccbc3ae

      SHA256

      36be123d5f8e487f6707b8f4935b416faf0b99ccde324ba98f0cd5ed6f16c62f

      SHA512

      8573ccfb8ae50d507b74babe3ec0cad5b51627f99dedaa11b8ecf11f4b6494d4c70ffd2eb9773ebfe889ee49313f228d9249f4338344dac9cc3fe0ff198367ec

    • C:\temp\libssp-0.dll

      Filesize

      88KB

      MD5

      1f521e8b258d2b09f66fb8c940452b72

      SHA1

      7d669fe4108d40ed431a6728a27a2efc5c153bd0

      SHA256

      7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462

      SHA512

      61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3

    • C:\temp\pidgin.exe

      Filesize

      108KB

      MD5

      c283b2379ea584aab52abee0844b02a0

      SHA1

      903f9c7dcadf578637d604be681588fffec90e9b

      SHA256

      8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

      SHA512

      a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

    • C:\temp\sqlite3.dll

      Filesize

      488KB

      MD5

      05ec7e9dee5c43b659d7843f6eb462a2

      SHA1

      1d37a930765e282b75b1d129258e21f683379245

      SHA256

      b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4

      SHA512

      fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6

    • memory/2448-15-0x00000000028C0000-0x00000000029B5000-memory.dmp

      Filesize

      980KB

    • memory/2448-3-0x00000000025D0000-0x00000000027C0000-memory.dmp

      Filesize

      1.9MB

    • memory/2448-13-0x00000000002C0000-0x00000000002DB000-memory.dmp

      Filesize

      108KB

    • memory/2448-12-0x0000000000880000-0x000000000089C000-memory.dmp

      Filesize

      112KB

    • memory/2448-4-0x00000000028C0000-0x00000000029B5000-memory.dmp

      Filesize

      980KB

    • memory/2448-0-0x00000000002C0000-0x00000000002DB000-memory.dmp

      Filesize

      108KB

    • memory/4528-30-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-8-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-11-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-16-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-31-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-32-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-36-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-33-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-35-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-37-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-14-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

    • memory/4528-42-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB