Analysis

  • max time kernel
    135s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2024 15:01

General

  • Target

    darkgate/14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe

  • Size

    474KB

  • MD5

    b8fb11ff8d082eac7c53b88d8ee2cbcd

  • SHA1

    7b868f47df830bbaaaedf2d8afbc7e4845dd23f6

  • SHA256

    14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4

  • SHA512

    34d183755ec5d648937c0bde61875ea790587e018d8b56cd3e6807f0ba0e032e6c6517b11c0a383a913c02e440ec9daf4de77452d20ee194b2b38ee44edcc77d

  • SSDEEP

    12288:+722AOFW/xShLEs447yHQjHt5Ht9RR0leqMk8fpQ2eazqnuI/QL:+aqFW5SEs447y8t5N9j0gqMDu2D+umc

Malware Config

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2596
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"
        2⤵
          PID:548
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
        1⤵
          PID:216
          • C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
            "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe"
            2⤵
              PID:2376
          • C:\Users\Admin\AppData\Local\Temp\darkgate\14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe
            "C:\Users\Admin\AppData\Local\Temp\darkgate\14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe"
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:436
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 580
              2⤵
              • Program crash
              PID:400
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 436 -ip 436
            1⤵
              PID:3296

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/436-1-0x0000000000400000-0x000000000047E000-memory.dmp

              Filesize

              504KB

            • memory/436-2-0x0000000000400000-0x000000000047E000-memory.dmp

              Filesize

              504KB