darktrack | 88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427

General

Target

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
Size

759KB
MD5

bddd8db7b2653b2282eef20419a63042
SHA1

e9c7576c0329d48b1803f87af64b5f71f7fe7143
SHA256

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427
SHA512

3396e51b338848893e269f224c4e9ab743acc30c8fad821d541dcd6af0639b75a8eeacc76c5ace7f528ec4a658a92613b4fd2b1edf5b2302b511669532df741b

Score

10^/10

darktrack rat stealer

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1984-5-0x00000000004605D8-mapping.dmp	family_darktrack
behavioral1/memory/1984-4-0x0000000000400000-0x00000000004A4000-memory.dmp	family_darktrack
behavioral1/memory/1984-7-0x0000000000400000-0x00000000004A4000-memory.dmp	family_darktrack

Suspicious use of SetThreadContext 1 IoCs

Processes:

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

description	pid	process	target process
PID 1724 set thread context of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

pid process

1984 88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

pid process

1724 88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

pid	process
1984	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

pid	process
1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

description	pid	process	target process
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
PID 1724 wrote to memory of 1984	1724	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

C:\Users\Admin\AppData\Local\Temp\88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
"C:\Users\Admin\AppData\Local\Temp\88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
"C:\Users\Admin\AppData\Local\Temp\88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-5-0x00000000004605D8-mapping.dmp

Download
memory/1984-4-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1984-6-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1984-7-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads