Netskope Threat Labs reports a new DarkGate variant delivered via MSI that uses a loading chain inspired by Cobalt Strike to reach its final payload. The malware employs multiple loaders (DLL side-loading, Delphi, AutoIt) across several stages to deliver DarkGate’s full capabilities. #DarkGate #MehCrypter #NetskopeThreatLabs #CAB #AutoIt
Keypoints
- The new DarkGate variant is delivered through a loading chain via MSI, with ties to Cobalt Strike beacon’s shellcode approach.
- Infection starts with a fake invoice email delivering a PDF; the PDF contains a CAB that leads to MSI download.
- Stage 1 uses DLL side-loading of dbgeng.dll via windbg.exe to execute a fake DLL during loading.
- Stage 2 uses a Delphi-based loader that decodes data2.bin to produce AutoIt binaries and runs them to further the infection.
- Stage 3 AutoIt script constructs a PE and loads it through a DOS-header-based mechanism, with a callback path to the loader.
- Stage 4 repeats Delphi loading, searches for an AutoIt signature AU3!EA06, and decrypts the final payload using XOR with multiple keys.
- Final DarkGate payload is decrypted and executed, with multiple SHA-256 samples and XOR keys observed in the campaign.
MITRE Techniques
- [T1566.001] Phishing – The infection starts via a fake invoice email delivering a PDF document to the victim. ‘The infection starts via a fake invoice email delivering a PDF document to the victim.’
- [T1574.002] DLL Side-Loading – The chain starts via the execution of the windbg.exe binary present in the CAB file. The DLL side-loading technique is used here in order to execute a fake version of the dbgeng.dll DLL file. ‘The chain starts via the execution of the windbg.exe binary present in the CAB file. The DLL side-loading technique is used here in order to execute a fake version of the dbgeng.dll DLL file.’
- [T1059] Command and Scripting Interpreter – The AutoIt script is responsible for constructing a PE file and executing it via the same DOS header approach. ‘The AutoIt script is responsible for constructing a PE file and executing it via the same DOS header approach.’
- [T1027] Obfuscated/Compressed Files and Information – The content next to the saved 8 bytes buffer is read and a multi-byte XOR operation is performed against it using the buffer as a XOR key. ‘The content next to the saved 8 bytes buffer is read and a multi-byte XOR operation is performed against it using the buffer as a XOR key.’
- [T1056.001] Keylogging – DarkGate’s broad feature set includes keylogging and other capabilities. ‘DarkGate appeals to many attackers because of its broad feature set, which includes HVNC, keylogging, information stealing…’
Indicators of Compromise
- [Process] windbg.exe – used in Stage 1 as part of DLL side-loading. Example: windbg.exe present in the CAB.
- [DLL] dbgeng.dll – side-loaded DLL used by windbg.exe to run the payload. Example: dbgeng.dll included in the CAB and loaded as SideLoader.dll.
- [Executable] AutoIt.exe – used to run the AutoIt script (script.au3). Example: AutoIt.exe being used to run the script.au3 script.
- [Script] script.au3 – AutoIt script that coordinates loading steps. Example: script.au3 content used to orchestrate loading.
- [Directory] C:tmpa – temporary directory created to write AutoIt outputs and final payload. Example: C:tmpa directory content.
- [File] data.bin – data file read and decoded by dbgeng.dll. Example: data.bin in the same directory.
- [File] data2.bin – second data file read and decoded for Stage 2 payloads. Example: data2.bin.
- [SHA256] 1fb6b8bed3a67ee4225f852c3d90fd2b629f2541ab431b4bd4d9d9f5bbd2c4b7, 567d828dab1022eda84f90592d6d95e331e0f2696e79ed7d86ddc095bb2efdc8, 99f25de5cc5614f4efd967db0dae50f20e2acbae9e98920aff3d98638b9ca1f1, de3f49e68c45db2f31d1cc1d10ff09f8cfce302b92a1f5361c8f34c3d78544e5, 68952e8c311d1573b62d02c60a189e8c248530d4584eef1c7f0ff5ee20d730ab, d4e766f81e567039c44ccca90ef192a7f063c1783224ee4be3e3d7786980e236, 5e94aa172460e74293db106a98327778ae2d32c6ce6592857a1ec0c581543572 – observed payload hashes.
- [XOR Key] vJDAbKIz, ELkMtLfA, RmDbBDsf, xfNwSUCl, tCFMLSBD – XOR keys used to decrypt staged payloads.
- [AutoItSignature] AU3!EA06 – AutoIt script signature observed in Stage 4 payload handling.
Read more: https://www.netskope.com/jp/blog/new-darkgate-variant-uses-a-new-loading-approach