f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8

General
Target

f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe

Filesize

1MB

Completed

28-02-2021 07:28

Score
10 /10
MD5

b8d7e501db694d31599c44c2a11ec36b

SHA1

336aaf0207e6be6826f0e2ca7c7d5198d2619275

SHA256

f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8

Malware Config
Signatures 6

Filter: none

  • DarkTrack

    Description

    DarkTrack is a remote administration tool written in delphi.

  • DarkTrack Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1388-3-0x0000000000400000-0x00000000004A8000-memory.dmpfamily_darktrack
    behavioral1/memory/1388-4-0x00000000004635F0-mapping.dmpfamily_darktrack
    behavioral1/memory/1388-7-0x0000000000400000-0x00000000004A8000-memory.dmpfamily_darktrack
  • Suspicious use of SetThreadContext
    f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1924 set thread context of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
  • Suspicious behavior: GetForegroundWindowSpam
    f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe

    Reported IOCs

    pidprocess
    1388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
  • Suspicious use of AdjustPrivilegeToken
    f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
  • Suspicious use of WriteProcessMemory
    f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1924 wrote to memory of 13881924f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exef138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
    PID 1388 wrote to memory of 19881388f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exenotepad.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
    "C:\Users\Admin\AppData\Local\Temp\f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe"
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\AppData\Local\Temp\f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
      C:\Users\Admin\AppData\Local\Temp\f138fdf8a37348b23095aa37f9ca819061c9336615f347f026f5b747861671b8.exe
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        PID:1988
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1388-3-0x0000000000400000-0x00000000004A8000-memory.dmp

                          • memory/1388-4-0x00000000004635F0-mapping.dmp

                          • memory/1388-7-0x0000000000400000-0x00000000004A8000-memory.dmp

                          • memory/1924-2-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

                          • memory/1924-6-0x00000000000F0000-0x00000000000F1000-memory.dmp

                          • memory/1988-9-0x0000000000220000-0x0000000000221000-memory.dmp

                          • memory/1988-8-0x0000000000000000-mapping.dmp