Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
-
Size
627KB
-
MD5
70b5ca289fa630db5715f047212a5403
-
SHA1
e6e4d63c0be8cbad0517c4ae1a56b1beefac5980
-
SHA256
71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166
-
SHA512
e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84
Score
10/10
Malware Config
Signatures
-
DarkTrack Payload 2 IoCs
resource yara_rule behavioral2/files/0x000800000000068f-6.dat family_darktrack behavioral2/files/0x000800000000068f-5.dat family_darktrack -
Executes dropped EXE 1 IoCs
pid Process 3608 Sys32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sys32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Sys32.exe" notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3608 Sys32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 4128 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 73 PID 4724 wrote to memory of 3608 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 76 PID 4724 wrote to memory of 3608 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 76 PID 4724 wrote to memory of 3608 4724 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe 76 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 4216 3608 Sys32.exe 77 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78 PID 3608 wrote to memory of 2776 3608 Sys32.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe"C:\Users\Admin\AppData\Local\Temp\71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵PID:4128
-
-
C:\Users\Admin\AppData\Roaming\Sys32.exe"C:\Users\Admin\AppData\Roaming\Sys32.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:4216
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
PID:2776
-
-