Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-04-2021 20:21
Static task
static1
Behavioral task
behavioral1
Sample
583DE02EC747F0316FB7B0E59BD858BD.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
583DE02EC747F0316FB7B0E59BD858BD.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
583DE02EC747F0316FB7B0E59BD858BD.exe
-
Size
3.2MB
-
MD5
583de02ec747f0316fb7b0e59bd858bd
-
SHA1
89e8b166e20db07846b4abcf81ff69c72e8a87ab
-
SHA256
777a1b5eb79e751f4684f825ef2a5df80433a2d4e20f921d4f747e904793f3d2
-
SHA512
f20189cc020395a6e4f8ad639912e0ba9750431ed03487f4f22ab016e1ea260782607c52e499a3d31e6d0793ef3aa847cf0027372c82882c465b785308362492
Score
10/10
Malware Config
Signatures
-
DarkTrack Payload 4 IoCs
resource yara_rule behavioral2/files/0x000200000001ab4f-8.dat family_darktrack behavioral2/files/0x000200000001ab4f-9.dat family_darktrack behavioral2/files/0x000100000001ab54-19.dat family_darktrack behavioral2/files/0x000100000001ab54-20.dat family_darktrack -
Executes dropped EXE 2 IoCs
pid Process 4180 server.exe 2780 DtServ32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\DtServ32sm.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DtServ32.exe" notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TypedURLs 583DE02EC747F0316FB7B0E59BD858BD.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2780 DtServ32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4704 583DE02EC747F0316FB7B0E59BD858BD.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 4180 4704 583DE02EC747F0316FB7B0E59BD858BD.exe 75 PID 4704 wrote to memory of 4180 4704 583DE02EC747F0316FB7B0E59BD858BD.exe 75 PID 4704 wrote to memory of 4180 4704 583DE02EC747F0316FB7B0E59BD858BD.exe 75 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 3220 4180 server.exe 76 PID 4180 wrote to memory of 4060 4180 server.exe 77 PID 4180 wrote to memory of 4060 4180 server.exe 77 PID 4180 wrote to memory of 4060 4180 server.exe 77 PID 4180 wrote to memory of 2780 4180 server.exe 79 PID 4180 wrote to memory of 2780 4180 server.exe 79 PID 4180 wrote to memory of 2780 4180 server.exe 79 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 512 2780 DtServ32.exe 80 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81 PID 2780 wrote to memory of 640 2780 DtServ32.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\583DE02EC747F0316FB7B0E59BD858BD.exe"C:\Users\Admin\AppData\Local\Temp\583DE02EC747F0316FB7B0E59BD858BD.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:3220
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\server.exe >> NUL3⤵PID:4060
-
-
C:\Users\Admin\AppData\Roaming\DtServ32.exe"C:\Users\Admin\AppData\Roaming\DtServ32.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:512
-
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
- Adds Run key to start application
PID:640
-
-
-