darktrack | af776fc957e51c8846258b4d8004e1a1

Sharing

Copy URL Twitter E-mail

General

Target
af776fc957e51c8846258b4d8004e1a1
Size 627KB
Sample220407-kpavgadhc2
SHA256 dfb278405d6f2c0795936304f4c8d2e572be0d2699477d5b68b4fcff67f9bf42
MD5 af776fc957e51c8846258b4d8004e1a1
SHA1 3baed603d9b56e085d56371397595f81edcf7b70
SHA512 dc1d06d9d55d5bfd008d3f1e272c60440b777552dccb76858b062d1affbeae4f6c84429e2db8df5c8bd25edfd4a6afef5b81d76eaa801e36d5b7efdd1e3f92ef
SSDEEP 12288:9OqvQomCg4G6q90tmPvj+GU/ttJuqwh3EQiXRUVZs4ixsiNhkApRawp:ZoovgbAKvBgtJuqwh3EQihUb1ifNhN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darktrack

Malware Config

Signatures

DarkTrack Payload 1 IoCs

resource	yara_rule
sample	family_darktrack

Darktrack family
darktrack

File Explorer

af776fc957e51c8846258b4d8004e1a1

.exe 627KB

af776fc957e51c8846258b4d8004e1a1

IMPHASH ee46edf42cfbc2785a30bfb17f6da9c2
SHA256 dfb278405d6f2c0795936304f4c8d2e572be0d2699477d5b68b4fcff67f9bf42
MD5 af776fc957e51c8846258b4d8004e1a1
SHA1 3baed603d9b56e085d56371397595f81edcf7b70
SHA512 dc1d06d9d55d5bfd008d3f1e272c60440b777552dccb76858b062d1affbeae4f6c84429e2db8df5c8bd25edfd4a6afef5b81d76eaa801e36d5b7efdd1e3f92ef
SSDEEP 12288:9OqvQomCg4G6q90tmPvj+GU/ttJuqwh3EQiXRUVZs4ixsiNhkApRawp:ZoovgbAKvBgtJuqwh3EQihUb1ifNhN
MD5 SHA1 SHA512 SSDEEP

windows x86

DarkTrack Payload

Minor OS version

Major OS version

Entry point

407024

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen GetErrorInfo SysFreeString SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA RegQueryValueExW RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExW RegOpenKeyExA RegOpenKeyW RegOpenKeyA RegFlushKey RegEnumValueA RegEnumKeyExW RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCreateKeyA RegCloseKey OpenThreadToken OpenProcessToken LookupPrivilegeValueA LookupPrivilegeNameA LookupPrivilegeDisplayNameA GetUserNameA GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid AdjustTokenPrivileges StartServiceA QueryServiceStatus QueryServiceConfigA OpenServiceA OpenSCManagerA GetServiceDisplayNameA EnumServicesStatusA ControlService CloseServiceHandle

user32

GetKeyboardType DestroyWindow LoadStringA MessageBoxA CharNextA CreateWindowExA mouse_event keybd_event VkKeyScanA UnregisterClassA TranslateMessage ToUnicodeEx SystemParametersInfoA ShowWindow SetWindowTextA SetWindowLongA SetKeyboardState SetForegroundWindow SetFocus SetCursorPos SetClipboardData SendMessageA ReleaseDC RegisterClassA PostQuitMessage PostMessageA PeekMessageA OpenClipboard MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxA MapVirtualKeyExA MapVirtualKeyA LoadStringA LoadIconA LoadCursorA IsWindowVisible IsWindow GetWindowThreadProcessId GetWindowTextA GetWindowRect GetWindowPlacement GetWindowLongA GetSystemMetrics GetSysColor GetMessageA GetKeyboardState GetKeyboardLayout GetKeyState GetKeyNameTextA GetIconInfo GetForegroundWindow GetDesktopWindow GetDC GetClipboardData GetClientRect GetClassInfoA GetAsyncKeyState FindWindowExA FindWindowA FillRect ExitWindowsEx EnumWindows EnableWindow EmptyClipboard DrawIconEx DispatchMessageA DestroyWindow DestroyIcon DefWindowProcA CreateIcon CloseClipboard CharNextA CharLowerBuffA CharUpperBuffA CharUpperA CharToOemA PrintWindow BlockInput LockWorkStation

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetTickCount QueryPerformanceCounter GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLastError GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess ExitThread CreateThread WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType CreateFileA CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA lstrlenA lstrcpyA lstrcmpA lstrcatA WriteProcessMemory WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQuery VirtualProtect VirtualFree VirtualAllocEx VirtualAlloc TerminateThread TerminateProcess SystemTimeToFileTime SuspendThread Sleep SetThreadPriority SetThreadLocale SetPriorityClass SetNamedPipeHandleState SetFilePointer SetEvent SetEndOfFile ResumeThread ResetEvent ReadProcessMemory ReadFile OpenProcess MultiByteToWideChar MulDiv MoveFileA LockResource LocalFree LoadResource LoadLibraryA LeaveCriticalSection IsBadReadPtr InitializeCriticalSection HeapFree HeapAlloc GlobalUnlock GlobalReAlloc GlobalMemoryStatus GlobalHandle GlobalLock GlobalFree GlobalAlloc GetVersionExA GetUserDefaultLangID GetTickCount GetThreadLocale GetTempPathA GetSystemDirectoryA GetStdHandle GetStartupInfoA GetShortPathNameA GetProcessTimes GetProcessHeap GetProcAddress GetPrivateProfileStringA GetPriorityClass GetModuleHandleA GetModuleFileNameA GetLogicalDriveStringsA GetLocaleInfoA GetLocalTime GetLastError GetFullPathNameA GetFileSize GetFileAttributesA GetExitCodeThread GetExitCodeProcess GetEnvironmentVariableA GetDriveTypeA GetDiskFreeSpaceA GetDateFormatA GetCurrentThreadId GetCurrentThread GetCurrentProcess GetComputerNameA GetCPInfo InterlockedIncrement InterlockedExchange InterlockedDecrement FreeLibrary FormatMessageA FindResourceExA FindNextFileA FindFirstFileA FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime ExitProcess EnumCalendarInfoA EnterCriticalSection DeleteFileA DeleteCriticalSection CreateThread CreateRemoteThread CreateProcessA CreatePipe CreateMutexA CreateFileA CreateEventA CreateDirectoryA CopyFileA CompareStringA CloseHandle Sleep OpenThread GetVersionExW

gdi32

UnrealizeObject StretchBlt SetWinMetaFileBits SetTextColor SetStretchBltMode SetROP2 SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject RealizePalette PlayEnhMetaFile PatBlt MoveToEx MaskBlt GetWindowOrgEx GetWinMetaFileBits GetTextMetricsA GetTextExtentPoint32A GetSystemPaletteEntries GetStockObject GetPixel GetPaletteEntries GetObjectA GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetCurrentPositionEx GetBrushOrgEx GetBitmapBits GdiFlush ExtTextOutA DeleteObject DeleteEnhMetaFile DeleteDC CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectA CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileA BitBlt

mpr

WNetOpenEnumA WNetEnumResourceA WNetCloseEnum

ole32

CLSIDFromProgID CoCreateInstance CoUninitialize CoInitialize CoInitializeEx

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

shell32

ShellExecuteA SHGetFileInfoA SHFileOperationA DragQueryFileW SHGetSpecialFolderPathA ShellExecuteA

wsock32

WSACleanup WSAStartup WSAGetLastError gethostbyname gethostbyaddr socket shutdown sendto send recv ioctlsocket inet_ntoa inet_addr htons connect closesocket bind

netapi32

NetApiBufferFree NetShareEnum

crypt32

CryptUnprotectData CryptUnprotectData

winmm

waveInUnprepareHeader waveInStart waveInReset waveInPrepareHeader waveInOpen waveInClose waveInAddBuffer mciSendStringA

ntdll

RtlSetProcessIsCritical

powrprof

IsPwrShutdownAllowed

msvcrt

_gcvt

msacm32

acmStreamUnprepareHeader acmStreamPrepareHeader acmStreamConvert acmStreamReset acmStreamSize acmStreamClose acmStreamOpen

iphlpapi

GetAdaptersInfo

shfolder

SHGetFolderPathA

Name

.text

Size

391KB

Virtual Size

390KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

23KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ