darkgate | 71d381c6bb60a155304bfc532f53caef17de842fbeee76c66def4a47f299fa92

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SystemSync.exe
Size

2.2MB
MD5

3e9c3cc6b0f1e8e8724377eb82909ff8
SHA1

313b0effb543efa6264e57fb5b6a2a048c57708d
SHA256

71d381c6bb60a155304bfc532f53caef17de842fbeee76c66def4a47f299fa92
SHA512

c87291bbb6916ed3ae4084302405b7e2a83432260502f599563644c3485010ed6977e5544468b933afee25ba8b09427f69e660c0c9085f7aa7e0b4b0bfdebd0c
SSDEEP

49152:6EcPUz0VuTpPc4JrA5aR3UD9Cc/rENUwwiw4jm59J92mbd4H57+dIxEZVKzr71:N0VQP1JrA5+l+92mbOH5zKg

Score

10^/10

darkgate drk3 discovery execution persistence stealer

Malware Config

Extracted

Family

darkgate

Botnet

drk3

todayput.shop

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
sEhfQzVh
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
drk3

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate
Darkgate family
darkgate

Detect DarkGate stealer 11 IoCs

resource	yara_rule
behavioral1/memory/2648-12-0x0000000002FB0000-0x0000000003305000-memory.dmp	family_darkgate_v6
behavioral1/memory/2692-24-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6
behavioral1/memory/2648-25-0x0000000002FB0000-0x0000000003305000-memory.dmp	family_darkgate_v6
behavioral1/memory/2692-28-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6
behavioral1/memory/2692-35-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6
behavioral1/memory/2692-36-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6
behavioral1/memory/2692-34-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6
behavioral1/memory/2692-37-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6
behavioral1/memory/2692-38-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6
behavioral1/memory/2840-39-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6
behavioral1/memory/2692-40-0x00000000022C0000-0x0000000002A62000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2648 created 1160	2648	Autoit3.exe	20
PID 2692 created 800	2692	GoogleUpdateCore.exe	25

Executes dropped EXE 1 IoCs

pid	Process
2648	Autoit3.exe

Loads dropped DLL 1 IoCs

pid	Process
2308	SystemSync.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\cecdcab = "\"C:\\ProgramData\\hhhebdh\\Autoit3.exe\" C:\\ProgramData\\hhhebdh\\bgkhhdd.a3x"	GoogleUpdateCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\cecdcab = "\"C:\\ProgramData\\hhhebdh\\Autoit3.exe\" C:\\ProgramData\\hhhebdh\\bgkhhdd.a3x"	GoogleUpdateCore.exe

Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs

Using AutoIT for possible automate script.

execution

AutoHotKey & AutoIT

T1059.010

pid	Process
2648	Autoit3.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Autoit3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemSync.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoogleUpdateCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoogleUpdateCore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoogleUpdateCore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2648	Autoit3.exe
2648	Autoit3.exe
2692	GoogleUpdateCore.exe
2692	GoogleUpdateCore.exe
2840	GoogleUpdateCore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	GoogleUpdateCore.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2424	WMIC.exe
Token: SeSecurityPrivilege	2424	WMIC.exe
Token: SeTakeOwnershipPrivilege	2424	WMIC.exe
Token: SeLoadDriverPrivilege	2424	WMIC.exe
Token: SeSystemProfilePrivilege	2424	WMIC.exe
Token: SeSystemtimePrivilege	2424	WMIC.exe
Token: SeProfSingleProcessPrivilege	2424	WMIC.exe
Token: SeIncBasePriorityPrivilege	2424	WMIC.exe
Token: SeCreatePagefilePrivilege	2424	WMIC.exe
Token: SeBackupPrivilege	2424	WMIC.exe
Token: SeRestorePrivilege	2424	WMIC.exe
Token: SeShutdownPrivilege	2424	WMIC.exe
Token: SeDebugPrivilege	2424	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2424	WMIC.exe
Token: SeRemoteShutdownPrivilege	2424	WMIC.exe
Token: SeUndockPrivilege	2424	WMIC.exe
Token: SeManageVolumePrivilege	2424	WMIC.exe
Token: 33	2424	WMIC.exe
Token: 34	2424	WMIC.exe
Token: 35	2424	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2424	WMIC.exe
Token: SeSecurityPrivilege	2424	WMIC.exe
Token: SeTakeOwnershipPrivilege	2424	WMIC.exe
Token: SeLoadDriverPrivilege	2424	WMIC.exe
Token: SeSystemProfilePrivilege	2424	WMIC.exe
Token: SeSystemtimePrivilege	2424	WMIC.exe
Token: SeProfSingleProcessPrivilege	2424	WMIC.exe
Token: SeIncBasePriorityPrivilege	2424	WMIC.exe
Token: SeCreatePagefilePrivilege	2424	WMIC.exe
Token: SeBackupPrivilege	2424	WMIC.exe
Token: SeRestorePrivilege	2424	WMIC.exe
Token: SeShutdownPrivilege	2424	WMIC.exe
Token: SeDebugPrivilege	2424	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2424	WMIC.exe
Token: SeRemoteShutdownPrivilege	2424	WMIC.exe
Token: SeUndockPrivilege	2424	WMIC.exe
Token: SeManageVolumePrivilege	2424	WMIC.exe
Token: 33	2424	WMIC.exe
Token: 34	2424	WMIC.exe
Token: 35	2424	WMIC.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2648	2308	SystemSync.exe	31
PID 2308 wrote to memory of 2648	2308	SystemSync.exe	31
PID 2308 wrote to memory of 2648	2308	SystemSync.exe	31
PID 2308 wrote to memory of 2648	2308	SystemSync.exe	31
PID 2648 wrote to memory of 2204	2648	Autoit3.exe	32
PID 2648 wrote to memory of 2204	2648	Autoit3.exe	32
PID 2648 wrote to memory of 2204	2648	Autoit3.exe	32
PID 2648 wrote to memory of 2204	2648	Autoit3.exe	32
PID 2204 wrote to memory of 2424	2204	cmd.exe	34
PID 2204 wrote to memory of 2424	2204	cmd.exe	34
PID 2204 wrote to memory of 2424	2204	cmd.exe	34
PID 2204 wrote to memory of 2424	2204	cmd.exe	34
PID 2648 wrote to memory of 2692	2648	Autoit3.exe	36
PID 2648 wrote to memory of 2692	2648	Autoit3.exe	36
PID 2648 wrote to memory of 2692	2648	Autoit3.exe	36
PID 2648 wrote to memory of 2692	2648	Autoit3.exe	36
PID 2648 wrote to memory of 2692	2648	Autoit3.exe	36
PID 2648 wrote to memory of 2692	2648	Autoit3.exe	36
PID 2648 wrote to memory of 2692	2648	Autoit3.exe	36
PID 2648 wrote to memory of 2692	2648	Autoit3.exe	36
PID 2692 wrote to memory of 2840	2692	GoogleUpdateCore.exe	37
PID 2692 wrote to memory of 2840	2692	GoogleUpdateCore.exe	37
PID 2692 wrote to memory of 2840	2692	GoogleUpdateCore.exe	37
PID 2692 wrote to memory of 2840	2692	GoogleUpdateCore.exe	37
PID 2692 wrote to memory of 2840	2692	GoogleUpdateCore.exe	37
PID 2692 wrote to memory of 2840	2692	GoogleUpdateCore.exe	37
PID 2692 wrote to memory of 2840	2692	GoogleUpdateCore.exe	37
PID 2692 wrote to memory of 2840	2692	GoogleUpdateCore.exe	37

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160
- C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2692

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:800
- C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2840

C:\Users\Admin\AppData\Local\Temp\SystemSync.exe
"C:\Users\Admin\AppData\Local\Temp\SystemSync.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- \??\c:\temp\test\Autoit3.exe
  "c:\temp\test\Autoit3.exe" c:\temp\test\script.a3x
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Command and Scripting Interpreter: AutoIT
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2648
- - \??\c:\windows\SysWOW64\cmd.exe
    "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\hhhebdh\kfbdddh
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get domain
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AutoHotKey & AutoIT

T1059.010

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\hhhebdh\ggacdbe

Filesize
1KB

MD5
7b751c05c792145017d36f8abff3e884

SHA1
e72c413fe1eae98e7ec01f8af8a544be3a48f41c

SHA256
e91f122c9662c2532d34f48e32817fba59d8e2877a570237c700289775f0c979

SHA512
3ce4fa9f9aca5e5da05dcaf63ac51d17e97650cf7fe6a52e9c38ea637fb70c3efb73867a614eafd3479dff729e140f701f129d5b831bf87f5e2e8e214b707026

Download Submit
C:\ProgramData\hhhebdh\kfbdddh

Filesize
54B

MD5
c8bbad190eaaa9755c8dfb1573984d81

SHA1
17ad91294403223fde66f687450545a2bad72af5

SHA256
7f136265128b7175fb67024a6ddd7524586b025725a878c07d76a9d8ad3dc2ac

SHA512
05f02cf90969b7b9a2de39eecdf810a1835325e7c83ffe81388c9866c6f79be6cdc8617f606a8fedc6affe6127bede4b143106a90289bbb9bf61d94c648059df

Download Submit
C:\Users\Admin\AppData\Roaming\hhBGchd

Filesize
32B

MD5
b2109fec7464e83cc3100fc94f956520

SHA1
a2a94181010fd5a400f5fe81aee04b5c183e2488

SHA256
3f552973815b38cf7dac8e932d2cb3f2339f76620f9df9231247ebe6207c0759

SHA512
720c63a07345232b19c7edf1657dfac42d0b8420dc7916c00bc5107646c4c080146a82152c6f3fd800ba13dfdd886b8e0de12d999a7601d58f4518a3d247a92e

Download Submit
C:\temp\cfhhahc

Filesize
4B

MD5
374b1e2a24a6c15ba8b0cdf2017dd228

SHA1
4bf47ba9fea5be8088c03f1bd9dfca0d6a411799

SHA256
2da64e18b54c029353c6519c2ab67eb54364b75779abae2e19ae226ccd0276ea

SHA512
760cbb04c34ed9bcecf2807bb57cf641c14c7c1eb564b72620a5e181860288d7b48fd50bb32d28f1b4774b672fa9e8d4d166526c0580d59ac4ce1b778d44acf5

Download Submit
C:\temp\cfhhahc

Filesize
4B

MD5
3c5d17f0eaba01a8dae7a642d3454698

SHA1
c55ade03a9589d9af67adf0a15a106977f4b7892

SHA256
d111d260236493ee62d3be2c3c4f21fde52481b42a7ba19c9f3016f228c7258d

SHA512
e2519da3058a8d6917bf1fa125d2f99a077593157a2988786ecda7374e7e6d96062428c6194e586f17987a17adae5910b94d0d08c93775a1753e1b87de40a32a

Download Submit
C:\temp\feabcdf

Filesize
4B

MD5
0d36f21117a514196cbc10a413faa94e

SHA1
3d02bb66fb56a8c3eea3988a91fdb1097a713e3b

SHA256
d0d100558a8d5a1719593b3b0433f2fb8c86a9292e906a755aac931ec18c63d0

SHA512
c52ecafb3cc7e95f3482d00b6152f76964d3cca25f3fe9fc8093d41d0da97577ef1420b7add6d48bd1883d3014929f4b05ce8abcf292c632668d0ae5a5085f6a

Download Submit
\??\c:\temp\test\script.a3x

Filesize
581KB

MD5
2bf27a4ef77513aa86659950f589a089

SHA1
e5238f7403f90cc1998f312504707c86585f9da5

SHA256
fce2d534623887f17922412cd8b9e4313a695db76573d69dda0f2693b3a0353f

SHA512
3c599dc4b5b88966f4657130324d122191500e1ecf4ac912a7c7d31c3d35b2fab9e951831484b63e4d0cfcaabfc7a305e4b91c448533fc1f2e2d4f6ad30fdb9d

Download Submit
\temp\test\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/2308-2-0x00000000020A0000-0x000000000221B000-memory.dmp

Filesize
1.5MB

Download
memory/2308-7-0x00000000020A0000-0x000000000221B000-memory.dmp

Filesize
1.5MB

Download
memory/2648-25-0x0000000002FB0000-0x0000000003305000-memory.dmp

Filesize
3.3MB

Download
memory/2648-12-0x0000000002FB0000-0x0000000003305000-memory.dmp

Filesize
3.3MB

Download
memory/2648-11-0x00000000009B0000-0x0000000000DB0000-memory.dmp

Filesize
4.0MB

Download
memory/2692-24-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download
memory/2692-28-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download
memory/2692-35-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download
memory/2692-36-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download
memory/2692-34-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download
memory/2692-37-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download
memory/2692-38-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download
memory/2692-40-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download
memory/2840-39-0x00000000022C0000-0x0000000002A62000-memory.dmp

Filesize
7.6MB

Download