Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
07/04/2022, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
af776fc957e51c8846258b4d8004e1a1.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
af776fc957e51c8846258b4d8004e1a1.exe
Resource
win10v2004-20220331-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target af776fc957e51c8846258b4d8004e1a1.exe
- Size 627KB
- Sample220407-kpavgadhc2
- SHA256 dfb278405d6f2c0795936304f4c8d2e572be0d2699477d5b68b4fcff67f9bf42
- MD5 af776fc957e51c8846258b4d8004e1a1
- SHA1 3baed603d9b56e085d56371397595f81edcf7b70
- SHA512 dc1d06d9d55d5bfd008d3f1e272c60440b777552dccb76858b062d1affbeae4f6c84429e2db8df5c8bd25edfd4a6afef5b81d76eaa801e36d5b7efdd1e3f92ef
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- DarkTrack Payload 2 IoCs
resource yara_rule behavioral2/files/0x0003000000021c4c-126.dat family_darktrack behavioral2/files/0x0003000000021c4c-127.dat family_darktrack - Executes dropped EXE 1 IoCs
pid Process 3092 srvhost.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation af776fc957e51c8846258b4d8004e1a1.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DtServ32sm.exe = "C:\\Users\\Admin\\AppData\\Roaming\\srvhost.exe" notepad.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3092 srvhost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 2684 2084 af776fc957e51c8846258b4d8004e1a1.exe 80 PID 2084 wrote to memory of 3092 2084 af776fc957e51c8846258b4d8004e1a1.exe 81 PID 2084 wrote to memory of 3092 2084 af776fc957e51c8846258b4d8004e1a1.exe 81 PID 2084 wrote to memory of 3092 2084 af776fc957e51c8846258b4d8004e1a1.exe 81 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 4672 3092 srvhost.exe 82 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83 PID 3092 wrote to memory of 968 3092 srvhost.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\af776fc957e51c8846258b4d8004e1a1.exe"C:\Users\Admin\AppData\Local\Temp\af776fc957e51c8846258b4d8004e1a1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵PID:2684
-
-
C:\Users\Admin\AppData\Roaming\srvhost.exe"C:\Users\Admin\AppData\Roaming\srvhost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:4672
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
PID:968
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\srvhost.exe
- Size 627KB
- SHA256 dfb278405d6f2c0795936304f4c8d2e572be0d2699477d5b68b4fcff67f9bf42
- MD5 af776fc957e51c8846258b4d8004e1a1
- SHA1 3baed603d9b56e085d56371397595f81edcf7b70
- SHA512 dc1d06d9d55d5bfd008d3f1e272c60440b777552dccb76858b062d1affbeae4f6c84429e2db8df5c8bd25edfd4a6afef5b81d76eaa801e36d5b7efdd1e3f92ef
- SSDEEP 12288:9OqvQomCg4G6q90tmPvj+GU/ttJuqwh3EQiXRUVZs4ixsiNhkApRawp:ZoovgbAKvBgtJuqwh3EQihUb1ifNhN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\srvhost.exe
- Size 627KB
- SHA256 dfb278405d6f2c0795936304f4c8d2e572be0d2699477d5b68b4fcff67f9bf42
- MD5 af776fc957e51c8846258b4d8004e1a1
- SHA1 3baed603d9b56e085d56371397595f81edcf7b70
- SHA512 dc1d06d9d55d5bfd008d3f1e272c60440b777552dccb76858b062d1affbeae4f6c84429e2db8df5c8bd25edfd4a6afef5b81d76eaa801e36d5b7efdd1e3f92ef
- SSDEEP 12288:9OqvQomCg4G6q90tmPvj+GU/ttJuqwh3EQiXRUVZs4ixsiNhkApRawp:ZoovgbAKvBgtJuqwh3EQihUb1ifNhN
- MD5 SHA1 SHA512 SSDEEP