darkgate | 891077c9c5725718409feda0e3ac7f6515aeebfffa25ca989ba0797ac7e6e168

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

darkgate/07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Size

437KB
MD5

149da23d732922b04f82d634750532f3
SHA1

c8dfb9b07103fb44f73aa1316337f1b846fcd34f
SHA256

07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf
SHA512

d86c22833053a83fcacdcd4eee86c9fc70a14eb1d588fe126378ca5ebbe7d46269b9e37a7c59f1bb5c5d70b573ae58bfc83047f6bb8be2d43398cbc67b7bfb09
SSDEEP

12288:OdJPpmYoSsK+dmLB/Vb6lW0eR591NlyWqnux/WAY:Ob+SsBSB/VOlW0eH91NlyW+uhWAY

Score

10^/10

darkgate discovery stealer

Malware Config

Extracted

Family

darkgate

Version

http://192.168.100.14

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
1377
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
JDJkPdCYhDHOLl
internal_mutex
dbaHbd
minimum_disk
100
minimum_ram
4096
ping_interval
20
rootkit
false
startup_persistence
false

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 11 IoCs

resource	yara_rule
behavioral7/memory/1288-2-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-7-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-6-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-8-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1660-5-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-12-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-16-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-15-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-14-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-13-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral7/memory/1288-17-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 1288	1660	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1660	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
1288	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1288	1660	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	31
PID 1660 wrote to memory of 1288	1660	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	31
PID 1660 wrote to memory of 1288	1660	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	31
PID 1660 wrote to memory of 1288	1660	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	31
PID 1660 wrote to memory of 1288	1660	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	31
PID 1660 wrote to memory of 1288	1660	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	31

C:\Users\Admin\AppData\Local\Temp\darkgate\07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
"C:\Users\Admin\AppData\Local\Temp\darkgate\07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\aggcahg\hhehkgh\gbfahkf

Filesize
121B

MD5
9e7be496a34f11228792387069983709

SHA1
3284ddb4391d0abc545da07d78e005bb1a8eac6d

SHA256
4768f9f965b117fcaa617783b4a00fed4e0247bbdfbb2f01b8cf7625bc8678a3

SHA512
27a32120633e3ede6ae2b1ecccac3f83a8d8bcebd1eab9a6977aee3c25a93febbd92b7eaac70c60ab04c136a8ad94064b912f3a6d30bfcc2b24ed6a47b1db12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeecfcc

Filesize
148B

MD5
72c70f63877800690bf71077f3bd8d26

SHA1
ea291a58abfc8ebe5910ee31c8cf0fd9604176a5

SHA256
e1e81ff4ece2894914acb43c8072d7e4d2742214e37aaadc8a00371718759f5c

SHA512
3f12e37cbab5a3625cc93dd1ccaa644d219bd45238200873460751edeca93443f6fe6ce21889cef2841ce22d2616eaa26e372166f068818a3138d206f566d0cb

Download Submit
memory/1288-6-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-2-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-8-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-7-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1288-12-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-16-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-15-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-13-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1288-17-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1660-5-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download