From DarkGate to DanaBot

MITRE Techniques

• [T1189] Drive-by Compromise – Drive-by downloads disguised as fake installers and fake reports leading to initial access. “drive-by downloads disguised as fake installers, such as an Advanced IP scanner, as well as fake document reports.”
• [T1059.005] Visual Basic – LNK, VBS, and MSI delivery leading to execution of the AutoIt script. “The loader delivers in a format of LNK, VBS, and MSI, which leads to the execution of the AutoIt script.”
• [T1547.001] Boot or Logon Autostart Execution – Persistence via Startup folder to run the malicious AutoIt script. “initial infection … via the Startup folder to run the malicious AutoIt script dropped under the ProgramData folder”
• [T1055] Process Injection – DarkGate performs process hollowing for core and payloads into multiple processes (GoogleUpdate.exe, TabTip32.exe, BraveUpdate.exe, MicrosoftEdgeUpdate.exe, ielowutil.exe). If hollowing fails, it injects into cmd.exe and can spawn notepad.exe. “DarkGate performs process hollowing for the core and additional payloads into one of the processes”
• [T1055.012] PPID Spoofing – Deception by spoofing the Parent Process ID to appear legitimate. “PPID spoofing involves manipulating the parent process ID attribute of a newly created process. This is done to deceive security solutions”
• [T1021.005] VNC – hVNC capability enabling remote control and remote service-like actions. “hVNC capability”
• [T1027] Obfuscated/Compressed Files and Information – Use of custom base64 encoding and ZLIB compression to split config and C2 data. “custom base64-encoding … ZLIB-compressed”
• [T1036] Masquerading – Decoy documents used (IrsForm1340.pdf) to mislead the user. “the loader opens the decoy PDF file”
• [T1490] Inhibit System Recovery – Ability to delete shadow copies and manipulate browser data, potentially impacting protection and recovery. “delete shadow copies (provided the user has administrative rights)”
• [T1071.001] Web Protocols – C2 communications over web protocols with domains like whatup.cloud and dreamteamup.shop. “DarkGate C2” and associated domains/hosts
• [T1003] OS Credential Dumping – Information stealing and credential theft capabilities embedded in DarkGate. “credential stealing”
• [T1496] Resource Hijacking – Crypto mining as part of DarkGate capabilities. “crypto mining”
• [T1056.001] Keylogging – Keylogger functionality mentioned among DarkGate features. “keylogger”