darkgate | 891077c9c5725718409feda0e3ac7f6515aeebfffa25ca989ba0797ac7e6e168

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

darkgate/07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Size

437KB
MD5

149da23d732922b04f82d634750532f3
SHA1

c8dfb9b07103fb44f73aa1316337f1b846fcd34f
SHA256

07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf
SHA512

d86c22833053a83fcacdcd4eee86c9fc70a14eb1d588fe126378ca5ebbe7d46269b9e37a7c59f1bb5c5d70b573ae58bfc83047f6bb8be2d43398cbc67b7bfb09
SSDEEP

12288:OdJPpmYoSsK+dmLB/Vb6lW0eR591NlyWqnux/WAY:Ob+SsBSB/VOlW0eH91NlyW+uhWAY

Score

10^/10

darkgate discovery stealer

Malware Config

Extracted

Family

darkgate

Version

http://192.168.100.14

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
1377
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
JDJkPdCYhDHOLl
internal_mutex
dbaHbd
minimum_disk
100
minimum_ram
4096
ping_interval
20
rootkit
false
startup_persistence
false

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 11 IoCs

resource	yara_rule
behavioral8/memory/4404-2-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-5-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-6-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-4-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/3720-3-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-10-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-12-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-13-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-11-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-14-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6
behavioral8/memory/4404-15-0x0000000000400000-0x0000000000474000-memory.dmp	family_darkgate_v6

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3720 set thread context of 4404	3720	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3720	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
3720	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
4404	cmd.exe
4404	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4404	3720	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	87
PID 3720 wrote to memory of 4404	3720	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	87
PID 3720 wrote to memory of 4404	3720	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	87
PID 3720 wrote to memory of 4404	3720	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	87
PID 3720 wrote to memory of 4404	3720	07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe	87

C:\Users\Admin\AppData\Local\Temp\darkgate\07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe
"C:\Users\Admin\AppData\Local\Temp\darkgate\07dc0c5ad87204c98eeab48bd9a10a7c2c3a69971b44621d06c3d4b09bc4e6bf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\afaebcd\heddffd\ebacgha

Filesize
121B

MD5
da69751acf26e347a31924f09382cbde

SHA1
65215a93450ea30693c54d1d52ae1ac33464c8fe

SHA256
123cabfa4c2743890c03bb518548f6f6bb6f7e17fa749e3b5d81b645ec9f1c18

SHA512
a0614d7c1995492cbb229567eba49d385371ae18d9d0f791836177cf700cec000ec92aa41a116b786bc0d253e44ecebcc1640a06171cbd6b5b5eb95e063e150d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ckeedfb

Filesize
148B

MD5
72c70f63877800690bf71077f3bd8d26

SHA1
ea291a58abfc8ebe5910ee31c8cf0fd9604176a5

SHA256
e1e81ff4ece2894914acb43c8072d7e4d2742214e37aaadc8a00371718759f5c

SHA512
3f12e37cbab5a3625cc93dd1ccaa644d219bd45238200873460751edeca93443f6fe6ce21889cef2841ce22d2616eaa26e372166f068818a3138d206f566d0cb

Download Submit
memory/3720-3-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-12-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-4-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-10-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-2-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-13-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-11-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-6-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-5-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/4404-15-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download