DarkGate Malware

DarkGate is a complete toolkit that provides attackers with extensive capabilities to fully compromise victim systems. Darkgate is loader/botnet malware. DarkGate malware has been out there since 2017.

Infection Chain:

The analysis mentioned in our report is based on the analysis of the files below.

In the DLL Side-loading stage, pure EXE files in the wild and malicious DLL file pairs such as windbg.exe and malicious dbgeng.dll or KeyScrambler.exe and KeyScrambler.dll are used. Malicious DLL reads `data.bin`, which is extracted from MSI, and gets an additional payload to decrypt `data2.bin`, which contains AutoIt launcher and Autoit script. The rest of the process is the same as VBScript.

DarkGate Final payload

C2 Communication

DarkGate encodes important constant strings in binary or data in C2 communication with Base64.

Configuration

DarkGate loads configuration saved in binary. In the case of the C2 server address, it is encoded in custom Base64. Other DarkGate settings are stored as plain text in the binary or encoded through Custom Base64. Plain DarkGate settings are formed as follows,

AntiVirus Bypass Detections:

DarkGate detects installed anti-virus into ten types listed below.

DarkGate Functionalities:

We now talk about the malicious actions that DarkGate can do. Because there are too many commands that C2 can send, we categorized those commands for better explanation.

Keylogging

Keylogging executes immediately after initial setup, regardless of the C2 command.

Collect Information

Manage Files

Steal Credentials

We can see that software created by NirSoft is used to steal various types of information.

Remove Data/Backups

DarkGate performs various malicious actions by utilizing programs or processes related to the browser

Privilege Escalation

method is using PsExec to obtain SYSTEM privileges

Inspect Network

Software\Microsoft\Windows\CurrentVersion\Internet Settings

— Key: ProxyEnable

— Key: ProxyServer

GUI Control

DarkGate supports remote control through the display. Attackers can use virtual display via Hidden VNC or Hidden AnyDesk

Reverse Shell

DarkGate also supports the use of traditional reverse shells. However, interaction with the reverse shell must be done through DarkGate

Run & Manage Processes

Managing DarkGate

Attackers can enable the test mode of some functions or debug messages to check DarkGate status.

MITRE ATT&CK TACTICS AND TECHNIQUES Covered by GRA: