Overview
overview
10Static
static
10darkgate/0...20.exe
windows7-x64
10darkgate/0...20.exe
windows10-2004-x64
10darkgate/0...24.exe
windows7-x64
1darkgate/0...24.exe
windows10-2004-x64
3darkgate/0...d2.exe
windows7-x64
10darkgate/0...d2.exe
windows10-2004-x64
10darkgate/0...bf.exe
windows7-x64
10darkgate/0...bf.exe
windows10-2004-x64
10darkgate/0...49.exe
windows7-x64
10darkgate/0...49.exe
windows10-2004-x64
10darkgate/0...fd.exe
windows7-x64
1darkgate/0...fd.exe
windows10-2004-x64
1darkgate/0...8f.exe
windows7-x64
darkgate/0...8f.exe
windows10-2004-x64
darkgate/0...be.exe
windows7-x64
10darkgate/0...be.exe
windows10-2004-x64
10darkgate/1...bb.exe
windows7-x64
10darkgate/1...bb.exe
windows10-2004-x64
10darkgate/1...ac.exe
windows7-x64
1darkgate/1...ac.exe
windows10-2004-x64
3darkgate/1...e6.exe
windows7-x64
1darkgate/1...e6.exe
windows10-2004-x64
3darkgate/1...50.exe
windows7-x64
1darkgate/1...50.exe
windows10-2004-x64
1darkgate/1...de.exe
windows7-x64
darkgate/1...de.exe
windows10-2004-x64
darkgate/1...e4.exe
windows7-x64
10darkgate/1...e4.exe
windows10-2004-x64
10darkgate/1...f2.exe
windows7-x64
1darkgate/1...f2.exe
windows10-2004-x64
3darkgate/1...90.exe
windows7-x64
10darkgate/1...90.exe
windows10-2004-x64
10Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 15:01
Static task
static1
Behavioral task
behavioral1
Sample
darkgate/0201fcee89c9b2eb6871f37d9f92c9c16857a1c09543b95abd62948237d48720.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
darkgate/0201fcee89c9b2eb6871f37d9f92c9c16857a1c09543b95abd62948237d48720.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
darkgate/046916c0ec8b2cc15901ed6b724d419de3ed6efbacd544ac7cef9947291ccc24.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
darkgate/046916c0ec8b2cc15901ed6b724d419de3ed6efbacd544ac7cef9947291ccc24.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
darkgate/0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
darkgate/0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
darkgate/07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
darkgate/07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
darkgate/083c28ace437a34a8811ae161e0d0208336f42cb3a0f416d4f6dd4e7bcde2249.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
darkgate/083c28ace437a34a8811ae161e0d0208336f42cb3a0f416d4f6dd4e7bcde2249.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
darkgate/0b08b4a9a8f624308f41096b687ec06e76d6703dac0bdf7d12362ca9ce3984fd.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
darkgate/0b08b4a9a8f624308f41096b687ec06e76d6703dac0bdf7d12362ca9ce3984fd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
darkgate/0dee02b21cfc3d8055e4ea59c4df9a4d113dbe5676ce4946ec7406749eeb238f.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
darkgate/0dee02b21cfc3d8055e4ea59c4df9a4d113dbe5676ce4946ec7406749eeb238f.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
darkgate/0e5f17f2697aea5447d90d79a827a72610238355bb29f0d7b27012d4e8a3c3be.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
darkgate/0e5f17f2697aea5447d90d79a827a72610238355bb29f0d7b27012d4e8a3c3be.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
darkgate/1059cbb1c50f300b1a9447453e1cca6c51dbd2cc901ea073e78047e71542b4bb.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
darkgate/1059cbb1c50f300b1a9447453e1cca6c51dbd2cc901ea073e78047e71542b4bb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
darkgate/10959b7b9a9d905c9cffdcddfc7567cefdd66bbe44ca7b5e302b57d2fa1b82ac.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
darkgate/10959b7b9a9d905c9cffdcddfc7567cefdd66bbe44ca7b5e302b57d2fa1b82ac.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
darkgate/10e69a62464edb0880e871362e62884136ad3026086d1e6873c9a67d52aea1e6.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
darkgate/10e69a62464edb0880e871362e62884136ad3026086d1e6873c9a67d52aea1e6.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
darkgate/13361b8acb85763dbf149732f9d5be0b3d028b958bd3b22411ee976a36dba450.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
darkgate/13361b8acb85763dbf149732f9d5be0b3d028b958bd3b22411ee976a36dba450.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
darkgate/145a0faa4e25006cc3decef0f1541ea5f0e5ab0c8c446cdb921ac7b6c6c87bde.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
darkgate/145a0faa4e25006cc3decef0f1541ea5f0e5ab0c8c446cdb921ac7b6c6c87bde.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
darkgate/14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
darkgate/14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
darkgate/186a474be7cd7fcac0e6b2747d0fcb90b7d7dd09ba93cf181780d823ddf6cef2.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
darkgate/186a474be7cd7fcac0e6b2747d0fcb90b7d7dd09ba93cf181780d823ddf6cef2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
darkgate/18d87c514ff25f817eac613c5f2ad39b21b6e04b6da6dbe8291f04549da2c290.exe
Resource
win7-20240903-en
General
-
Target
darkgate/14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe
-
Size
474KB
-
MD5
b8fb11ff8d082eac7c53b88d8ee2cbcd
-
SHA1
7b868f47df830bbaaaedf2d8afbc7e4845dd23f6
-
SHA256
14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4
-
SHA512
34d183755ec5d648937c0bde61875ea790587e018d8b56cd3e6807f0ba0e032e6c6517b11c0a383a913c02e440ec9daf4de77452d20ee194b2b38ee44edcc77d
-
SSDEEP
12288:+722AOFW/xShLEs447yHQjHt5Ht9RR0leqMk8fpQ2eazqnuI/QL:+aqFW5SEs447y8t5N9j0gqMDu2D+umc
Malware Config
Signatures
-
Detect DarkGate stealer 2 IoCs
resource yara_rule behavioral28/memory/436-1-0x0000000000400000-0x000000000047E000-memory.dmp family_darkgate_v6 behavioral28/memory/436-2-0x0000000000400000-0x000000000047E000-memory.dmp family_darkgate_v6 -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 436 created 2596 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 44 PID 436 created 216 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 75 -
Program crash 1 IoCs
pid pid_target Process procid_target 400 436 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 436 wrote to memory of 548 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 87 PID 436 wrote to memory of 548 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 87 PID 436 wrote to memory of 548 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 87 PID 436 wrote to memory of 2376 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 96 PID 436 wrote to memory of 2376 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 96 PID 436 wrote to memory of 2376 436 14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe 96
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2596
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"2⤵PID:548
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:216
-
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe"2⤵PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\darkgate\14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe"C:\Users\Admin\AppData\Local\Temp\darkgate\14f5e6c5c7e02acf97a44e476850c5c3df08057f6b93a5aae298d98e6a4dcfe4.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 5802⤵
- Program crash
PID:400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 436 -ip 4361⤵PID:3296