583DE02EC747F0316FB7B0E59BD858BD.exe

General
Target

583DE02EC747F0316FB7B0E59BD858BD.exe

Filesize

3MB

Completed

07-04-2021 20:23

Score
10 /10
MD5

583de02ec747f0316fb7b0e59bd858bd

SHA1

89e8b166e20db07846b4abcf81ff69c72e8a87ab

SHA256

777a1b5eb79e751f4684f825ef2a5df80433a2d4e20f921d4f747e904793f3d2

Malware Config
Signatures 9

Filter: none

Defense Evasion
Discovery
Persistence
  • DarkTrack

    Description

    DarkTrack is a remote administration tool written in delphi.

  • DarkTrack Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/files/0x000200000001ab4f-8.datfamily_darktrack
    behavioral2/files/0x000200000001ab4f-9.datfamily_darktrack
    behavioral2/files/0x000100000001ab54-19.datfamily_darktrack
    behavioral2/files/0x000100000001ab54-20.datfamily_darktrack
  • Executes dropped EXE
    server.exeDtServ32.exe

    Reported IOCs

    pidprocess
    4180server.exe
    2780DtServ32.exe
  • Adds Run key to start application
    notepad.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\DtServ32sm.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DtServ32.exe"notepad.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Modifies Internet Explorer settings
    583DE02EC747F0316FB7B0E59BD858BD.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TypedURLs583DE02EC747F0316FB7B0E59BD858BD.exe
  • Suspicious behavior: GetForegroundWindowSpam
    DtServ32.exe

    Reported IOCs

    pidprocess
    2780DtServ32.exe
  • Suspicious use of AdjustPrivilegeToken
    583DE02EC747F0316FB7B0E59BD858BD.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege4704583DE02EC747F0316FB7B0E59BD858BD.exe
  • Suspicious use of WriteProcessMemory
    583DE02EC747F0316FB7B0E59BD858BD.exeserver.exeDtServ32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4704 wrote to memory of 41804704583DE02EC747F0316FB7B0E59BD858BD.exeserver.exe
    PID 4704 wrote to memory of 41804704583DE02EC747F0316FB7B0E59BD858BD.exeserver.exe
    PID 4704 wrote to memory of 41804704583DE02EC747F0316FB7B0E59BD858BD.exeserver.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 32204180server.exenotepad.exe
    PID 4180 wrote to memory of 40604180server.execmd.exe
    PID 4180 wrote to memory of 40604180server.execmd.exe
    PID 4180 wrote to memory of 40604180server.execmd.exe
    PID 4180 wrote to memory of 27804180server.exeDtServ32.exe
    PID 4180 wrote to memory of 27804180server.exeDtServ32.exe
    PID 4180 wrote to memory of 27804180server.exeDtServ32.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 5122780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
    PID 2780 wrote to memory of 6402780DtServ32.exenotepad.exe
Processes 7
  • C:\Users\Admin\AppData\Local\Temp\583DE02EC747F0316FB7B0E59BD858BD.exe
    "C:\Users\Admin\AppData\Local\Temp\583DE02EC747F0316FB7B0E59BD858BD.exe"
    Modifies Internet Explorer settings
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        PID:3220
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\server.exe >> NUL
        PID:4060
      • C:\Users\Admin\AppData\Roaming\DtServ32.exe
        "C:\Users\Admin\AppData\Roaming\DtServ32.exe"
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          PID:512
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          Adds Run key to start application
          PID:640
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Local\Temp\server.exe

                      MD5

                      eab859092958653767665cf47be684ce

                      SHA1

                      15a8de33ed414584c5ed2c3fc5372d96538a562c

                      SHA256

                      7d8657f721a178f803e5d86d6425db7d79b85bff386c058d07d20a3cfa2f3b6f

                      SHA512

                      ccd340ea6aaa622b5d0af84b63760557284cd39c4736b6c87faa0cbd73ce8503dfb8b8c8ac11b696d218be470630467c16cab89fb6a95fd626735438db0a2353

                    • C:\Users\Admin\AppData\Local\Temp\server.exe

                      MD5

                      eab859092958653767665cf47be684ce

                      SHA1

                      15a8de33ed414584c5ed2c3fc5372d96538a562c

                      SHA256

                      7d8657f721a178f803e5d86d6425db7d79b85bff386c058d07d20a3cfa2f3b6f

                      SHA512

                      ccd340ea6aaa622b5d0af84b63760557284cd39c4736b6c87faa0cbd73ce8503dfb8b8c8ac11b696d218be470630467c16cab89fb6a95fd626735438db0a2353

                    • C:\Users\Admin\AppData\Roaming\DtServ32.exe

                      MD5

                      eab859092958653767665cf47be684ce

                      SHA1

                      15a8de33ed414584c5ed2c3fc5372d96538a562c

                      SHA256

                      7d8657f721a178f803e5d86d6425db7d79b85bff386c058d07d20a3cfa2f3b6f

                      SHA512

                      ccd340ea6aaa622b5d0af84b63760557284cd39c4736b6c87faa0cbd73ce8503dfb8b8c8ac11b696d218be470630467c16cab89fb6a95fd626735438db0a2353

                    • C:\Users\Admin\AppData\Roaming\DtServ32.exe

                      MD5

                      eab859092958653767665cf47be684ce

                      SHA1

                      15a8de33ed414584c5ed2c3fc5372d96538a562c

                      SHA256

                      7d8657f721a178f803e5d86d6425db7d79b85bff386c058d07d20a3cfa2f3b6f

                      SHA512

                      ccd340ea6aaa622b5d0af84b63760557284cd39c4736b6c87faa0cbd73ce8503dfb8b8c8ac11b696d218be470630467c16cab89fb6a95fd626735438db0a2353

                    • memory/512-21-0x0000000000000000-mapping.dmp

                    • memory/640-24-0x0000000002F30000-0x0000000002F31000-memory.dmp

                    • memory/640-23-0x0000000000000000-mapping.dmp

                    • memory/2780-18-0x0000000000000000-mapping.dmp

                    • memory/3220-15-0x0000000000000000-mapping.dmp

                    • memory/3220-16-0x0000000002C20000-0x0000000002C21000-memory.dmp

                    • memory/4060-17-0x0000000000000000-mapping.dmp

                    • memory/4180-7-0x0000000000000000-mapping.dmp

                    • memory/4704-13-0x000000001B037000-0x000000001B039000-memory.dmp

                    • memory/4704-14-0x000000001B039000-0x000000001B03F000-memory.dmp

                    • memory/4704-12-0x000000001B035000-0x000000001B037000-memory.dmp

                    • memory/4704-11-0x000000001B034000-0x000000001B035000-memory.dmp

                    • memory/4704-10-0x000000001B032000-0x000000001B034000-memory.dmp

                    • memory/4704-6-0x00000000023A0000-0x00000000023A1000-memory.dmp

                    • memory/4704-5-0x000000001B030000-0x000000001B032000-memory.dmp

                    • memory/4704-3-0x0000000000240000-0x0000000000241000-memory.dmp

                    • memory/4704-2-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp