71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

General
Target

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe

Filesize

627KB

Completed

28-02-2021 07:23

Score
10 /10
MD5

70b5ca289fa630db5715f047212a5403

SHA1

e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

SHA256

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

Malware Config
Signatures 7

Filter: none

Defense Evasion
Discovery
Persistence
  • DarkTrack

    Description

    DarkTrack is a remote administration tool written in delphi.

  • DarkTrack Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/files/0x000800000000068f-6.datfamily_darktrack
    behavioral2/files/0x000800000000068f-5.datfamily_darktrack
  • Executes dropped EXE
    Sys32.exe

    Reported IOCs

    pidprocess
    3608Sys32.exe
  • Adds Run key to start application
    notepad.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sys32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Sys32.exe"notepad.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: GetForegroundWindowSpam
    Sys32.exe

    Reported IOCs

    pidprocess
    3608Sys32.exe
  • Suspicious use of WriteProcessMemory
    71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exeSys32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 4128472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exenotepad.exe
    PID 4724 wrote to memory of 3608472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exeSys32.exe
    PID 4724 wrote to memory of 3608472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exeSys32.exe
    PID 4724 wrote to memory of 3608472471d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exeSys32.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 42163608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
    PID 3608 wrote to memory of 27763608Sys32.exenotepad.exe
Processes 5
  • C:\Users\Admin\AppData\Local\Temp\71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
    "C:\Users\Admin\AppData\Local\Temp\71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe"
    Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      PID:4128
    • C:\Users\Admin\AppData\Roaming\Sys32.exe
      "C:\Users\Admin\AppData\Roaming\Sys32.exe"
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:3608
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        PID:4216
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        Adds Run key to start application
        PID:2776
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Roaming\Sys32.exe

                      MD5

                      70b5ca289fa630db5715f047212a5403

                      SHA1

                      e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

                      SHA256

                      71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

                      SHA512

                      e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

                    • C:\Users\Admin\AppData\Roaming\Sys32.exe

                      MD5

                      70b5ca289fa630db5715f047212a5403

                      SHA1

                      e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

                      SHA256

                      71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

                      SHA512

                      e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

                    • memory/2776-10-0x00000000032D0000-0x00000000032D1000-memory.dmp

                    • memory/2776-9-0x0000000000000000-mapping.dmp

                    • memory/3608-4-0x0000000000000000-mapping.dmp

                    • memory/4128-2-0x0000000000000000-mapping.dmp

                    • memory/4128-3-0x0000000002D60000-0x0000000002D61000-memory.dmp

                    • memory/4216-7-0x0000000000000000-mapping.dmp

                    • memory/4724-11-0x0000000000630000-0x0000000000631000-memory.dmp

                    • memory/4724-12-0x00000000005D0000-0x00000000005D1000-memory.dmp