darktrack | 88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427

General

Target

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
Size

759KB
MD5

bddd8db7b2653b2282eef20419a63042
SHA1

e9c7576c0329d48b1803f87af64b5f71f7fe7143
SHA256

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427
SHA512

3396e51b338848893e269f224c4e9ab743acc30c8fad821d541dcd6af0639b75a8eeacc76c5ace7f528ec4a658a92613b4fd2b1edf5b2302b511669532df741b

Score

10^/10

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/756-4-0x0000000000400000-0x00000000004A4000-memory.dmp	family_darktrack
behavioral2/memory/756-5-0x00000000004605D8-mapping.dmp	family_darktrack
behavioral2/memory/756-6-0x0000000000400000-0x00000000004A4000-memory.dmp	family_darktrack

Suspicious use of SetThreadContext 1 IoCs

Processes:

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

description	pid	Process	procid_target
PID 640 set thread context of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

pid	Process
756	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

pid	Process
640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe

description	pid	Process	procid_target
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75
PID 640 wrote to memory of 756	640	88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe	75

C:\Users\Admin\AppData\Local\Temp\88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
"C:\Users\Admin\AppData\Local\Temp\88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe
  "C:\Users\Admin\AppData\Local\Temp\88cabbf4309f6b749bc21ebd4e780d445ae427014413db0c5b752e734cfca427.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:756

memory/756-4-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/756-5-0x00000000004605D8-mapping.dmp

Download
memory/756-6-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download