DarkGate - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/darkgate/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:12:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgModification of Windows Error Reporting Registry Key by DarkGate Malwarehttps://feed.craftedsignal.io/briefs/2026-10-windows-wer-dontshowui-modification/Mon, 12 Oct 2026 18:12:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-windows-wer-dontshowui-modification/The DarkGate malware modifies the Windows Error Reporting 'DontShowUI' registry key to 0x00000001, suppressing error dialogs to remain stealthy during malicious installation.DarkGate malware, identified in multiple campaigns, performs modifications to the Windows Error Reporting (WER) registry configuration as a defensive evasion tactic. Specifically, it targets the 'DontShowUI' registry value within the 'SOFTWARE\Microsoft\Windows\Windows Error Reporting' path, setting the value to '0x00000001'. By performing this modification, the malware suppresses Windows error reporting dialogs that would typically trigger if a process crashes during the execution of malicious payloads. This behavior is a key indicator of stealth-oriented malware installation, as it prevents alerting the user or system administrators to abnormal application behavior during the initial deployment phase. Defenders should monitor for registry modifications to this path to identify processes attempting to evade standard OS-level error notifications.

Attack Chain

  1. Initial delivery or execution of the DarkGate malware binary.
  2. Malware checks environment for specific security software or sandbox artifacts.
  3. Malware initiates persistence and installation routines on the victim host.
  4. Malware accesses the registry path 'HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting'.
  5. Malware performs a write operation to set the 'DontShowUI' value to '0x00000001'.
  6. Malware proceeds with main malicious payload execution, such as C2 communication or data exfiltration.
  7. If a crash occurs during execution, the OS suppresses the error notification, preventing user discovery.

Impact

The suppression of WER dialogs allows the DarkGate malware to operate without generating user-visible alerts, which increases the likelihood of a successful, undetected installation. This technique is designed to bypass basic user awareness and diagnostic telemetry that might otherwise highlight the presence of malicious software during its setup phase. Failure to detect this activity leaves the environment susceptible to the full functionality of the DarkGate payload, which includes remote access capabilities and credential theft.

Recommendation

  1. Deploy the provided Sigma rule to detect unauthorized modifications to the 'DontShowUI' registry value via Sysmon Event ID 13.
  2. Implement monitoring for 'SetRegistryValue' actions targeting the 'Windows Error Reporting' hive.
  3. Validate internal configurations to ensure that registry monitoring covers the HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting path.
  4. Use the risk-based alerting framework to aggregate instances of this registry modification with other suspicious behaviors associated with DarkGate.
]]>mediumthreatDarkGate Malware Registry Modification for Remote Desktop Persistencehttps://feed.craftedsignal.io/briefs/2026-10-darkgate-registry-modification/Mon, 12 Oct 2026 18:11:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-darkgate-registry-modification/The DarkGate malware modifies the Windows registry key 'DisableRemoteDesktopAntiAlias' to 0x00000001, disabling anti-aliasing to optimize remote control capabilities and maintain unauthorized access.DarkGate malware, a sophisticated threat actor toolset, has been observed modifying the Windows registry key 'DisableRemoteDesktopAntiAlias' to a value of 0x00000001. This specific modification is intended to disable font anti-aliasing for Remote Desktop Protocol (RDP) sessions, a technique used by the malware to enhance the quality and performance of its remote control sessions for the attacker. By altering this setting, the malware ensures that its clandestine remote access operations are more responsive and visually clear, facilitating easier movement and command execution on compromised hosts. This activity is a critical indicator of post-compromise activity, suggesting the attacker has achieved sufficient privilege to manipulate system settings to maintain long-term persistence and refined control over the target environment.

Attack Chain

  1. Initial infection typically via malicious email attachment or drive-by download.
  2. Malware payload executes on the target endpoint.
  3. Malware gains persistence and elevates privileges if necessary.
  4. Malware performs reconnaissance on the system configuration.
  5. Attacker scripts modify the Windows Registry key 'DisableRemoteDesktopAntiAlias' to 0x00000001.
  6. Malware configures or leverages existing RDP functionality for stealthy remote control.
  7. Attacker maintains remote access to the host for data exfiltration or lateral movement.

Impact

Successful execution of this registry modification allows the DarkGate malware to achieve optimized remote control over a victim machine. This compromises the confidentiality and integrity of the affected host, providing the attacker with a stable channel to execute further malicious commands, steal sensitive data, and navigate the corporate network. If left unmonitored, this access can lead to widespread credential theft or ransomware deployment depending on the attacker's ultimate objective.

Recommendation

  • Deploy the provided Sigma rule to monitor for registry modification events on the identified key.
  • Configure Sysmon EventID 13 to record modifications to 'Terminal Services' registry subkeys.
  • Use the drilldown search provided in the brief to identify hosts with this registry modification for further incident investigation.
  • Filter alerts based on legitimate system administration activity, such as authorized configuration changes by IT staff.
]]>mediumthreatdarkgatemalwaredefense-evasionwindows