darktrack | 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

General

Target

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
Size

627KB
MD5

70b5ca289fa630db5715f047212a5403
SHA1

e6e4d63c0be8cbad0517c4ae1a56b1beefac5980
SHA256

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166
SHA512

e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

Score

10^/10

darktrack persistence rat stealer

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Sys32.exe	family_darktrack
C:\Users\Admin\AppData\Roaming\Sys32.exe	family_darktrack

Executes dropped EXE 1 IoCs

Processes:

Sys32.exe

pid process

3608 Sys32.exe

pid	process
3608	Sys32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

notepad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sys32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Sys32.exe"	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Sys32.exe

pid process

3608 Sys32.exe

pid	process
3608	Sys32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exeSys32.exe

description	pid	process	target process
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 4128	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 4724 wrote to memory of 3608	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	Sys32.exe
PID 4724 wrote to memory of 3608	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	Sys32.exe
PID 4724 wrote to memory of 3608	4724	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	Sys32.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 4216	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe
PID 3608 wrote to memory of 2776	3608	Sys32.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
"C:\Users\Admin\AppData\Local\Temp\71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  PID:4128
- C:\Users\Admin\AppData\Roaming\Sys32.exe
  "C:\Users\Admin\AppData\Roaming\Sys32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Adds Run key to start application
    PID:2776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sys32.exe

MD5
70b5ca289fa630db5715f047212a5403

SHA1
e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

SHA256
71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

SHA512
e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

Download Submit
C:\Users\Admin\AppData\Roaming\Sys32.exe

MD5
70b5ca289fa630db5715f047212a5403

SHA1
e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

SHA256
71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

SHA512
e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

Download Submit
memory/2776-10-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/2776-9-0x0000000000000000-mapping.dmp

Download
memory/3608-4-0x0000000000000000-mapping.dmp

Download
memory/4128-2-0x0000000000000000-mapping.dmp

Download
memory/4128-3-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/4216-7-0x0000000000000000-mapping.dmp

Download
memory/4724-11-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/4724-12-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads