darkgate | 891077c9c5725718409feda0e3ac7f6515aeebfffa25ca989ba0797ac7e6e168

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

darkgate/0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
Size

476KB
MD5

0ba33b5dbd3e450986c9627889575e26
SHA1

72e01bab823dea6d24f340481c8fd860ecb94ffd
SHA256

0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2
SHA512

f0159b06a2dc99d260a2bb6c756838956a6a79528a76a8f81f7a4e1f6b11222346d450b373c5f7a71dffa36c25a4d5f40d8cd68ee49b211044c3c92e4d392970
SSDEEP

12288:l0yYjNuWRUFBV0JBnSA/e8MosoxXn9+ECqnub/hlrn:lDquW+50jnSA2Toso19lC+ubhRn

Score

10^/10

darkgate discovery stealer

Malware Config

Extracted

Family

darkgate

Version

4.8.9

http://178.63.53.44

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 1 IoCs

resource	yara_rule
behavioral6/memory/852-1-0x0000000000400000-0x000000000047F000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 852 created 3928	852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe	60
PID 852 created 2712	852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe	46

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	852	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 216	852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe	87
PID 852 wrote to memory of 216	852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe	87
PID 852 wrote to memory of 216	852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe	87
PID 852 wrote to memory of 2600	852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe	95
PID 852 wrote to memory of 2600	852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe	95
PID 852 wrote to memory of 2600	852	0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe	95

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2712
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe"
  2⤵
  PID:2600

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3928
- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe
  "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe"
  2⤵
  PID:216

C:\Users\Admin\AppData\Local\Temp\darkgate\0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe
"C:\Users\Admin\AppData\Local\Temp\darkgate\0758bae88bcbffe93e6022920e7dac6f76c3d00a6d0948eb46eaf6b4db6324d2.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 788
  2⤵
  - Program crash
  PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 852 -ip 852
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-1-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download