darktrack | 399b5ca1eee21d07a146800fbccb360c524171237b49b1fa415fbabd0c6b92e8

General

Target

server.exe
Size

627KB
MD5

ccadb01dd1b49d0feb520c6bf7f819ef
SHA1

f0a859f869fe2c4c01541f7777be40b97fa8820d
SHA256

399b5ca1eee21d07a146800fbccb360c524171237b49b1fa415fbabd0c6b92e8
SHA512

82bbcdee9acf630fc8e1f15bafec31e2d7f6ac6f998006a4d64ea2b13c7d7a78f2fb51fa6f652ad65dab7e191fd8b17cda3b570ef0101374e1d1b0682932d77c

Score

10^/10

darktrack persistence rat stealer

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\DtServ32.exe	family_darktrack
C:\Users\Admin\AppData\Roaming\DtServ32.exe	family_darktrack

Executes dropped EXE 1 IoCs

Processes:

DtServ32.exe

pid process

3356 DtServ32.exe

pid	process
3356	DtServ32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

notepad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\DtServ32sm.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DtServ32.exe"	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

DtServ32.exe

pid process

3356 DtServ32.exe

pid	process
3356	DtServ32.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

server.exeDtServ32.exe

description	pid	process	target process
PID 656 wrote to memory of 3080	656	server.exe	cmd.exe
PID 656 wrote to memory of 3080	656	server.exe	cmd.exe
PID 656 wrote to memory of 3080	656	server.exe	cmd.exe
PID 656 wrote to memory of 3356	656	server.exe	DtServ32.exe
PID 656 wrote to memory of 3356	656	server.exe	DtServ32.exe
PID 656 wrote to memory of 3356	656	server.exe	DtServ32.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe
PID 3356 wrote to memory of 2028	3356	DtServ32.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\server.exe >> NUL
  2⤵
  PID:3080
- C:\Users\Admin\AppData\Roaming\DtServ32.exe
  "C:\Users\Admin\AppData\Roaming\DtServ32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Adds Run key to start application
    PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DtServ32.exe

MD5
ccadb01dd1b49d0feb520c6bf7f819ef

SHA1
f0a859f869fe2c4c01541f7777be40b97fa8820d

SHA256
399b5ca1eee21d07a146800fbccb360c524171237b49b1fa415fbabd0c6b92e8

SHA512
82bbcdee9acf630fc8e1f15bafec31e2d7f6ac6f998006a4d64ea2b13c7d7a78f2fb51fa6f652ad65dab7e191fd8b17cda3b570ef0101374e1d1b0682932d77c

Download Submit
C:\Users\Admin\AppData\Roaming\DtServ32.exe

MD5
ccadb01dd1b49d0feb520c6bf7f819ef

SHA1
f0a859f869fe2c4c01541f7777be40b97fa8820d

SHA256
399b5ca1eee21d07a146800fbccb360c524171237b49b1fa415fbabd0c6b92e8

SHA512
82bbcdee9acf630fc8e1f15bafec31e2d7f6ac6f998006a4d64ea2b13c7d7a78f2fb51fa6f652ad65dab7e191fd8b17cda3b570ef0101374e1d1b0682932d77c

Download Submit
memory/2028-118-0x0000000000000000-mapping.dmp

Download
memory/2028-119-0x0000000002A00000-0x0000000002AAE000-memory.dmp

Filesize
696KB

Download
memory/3080-114-0x0000000000000000-mapping.dmp

Download
memory/3356-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads