darktrack | 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245

General

Target

1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
Size

772KB
MD5

788b015ff15332bea73361bbc41fdda0
SHA1

cb0691054443686d034a0a3d47e57e2afee52830
SHA256

1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245
SHA512

13d4d74b99b3b28cbeae2f13a69c873a085217f01c2e361583f8ffb8e8aa95dbe4b3d804d48a4cba4bb73b7c5417fab52f71b2759c006a3d87e4f75ae6224633

Score

10^/10

darktrack rat stealer

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack Payload 11 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1380-57-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-58-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-60-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-62-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-63-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-65-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-68-0x00000000004635F0-mapping.dmp	family_darktrack
behavioral1/memory/1380-67-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-69-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-71-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral1/memory/1380-74-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack

Suspicious use of SetThreadContext 1 IoCs

Processes:

1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe

description	pid	process	target process
PID 1312 set thread context of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe

pid process

1380 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe

pid	process
1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe

description	pid	process	target process
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1312 wrote to memory of 1380	1312	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe
PID 1380 wrote to memory of 1708	1380	1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
"C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
"C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-63-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-68-0x00000000004635F0-mapping.dmp

Download
memory/1380-57-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-58-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-60-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-62-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-55-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-65-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-54-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-67-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-69-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-70-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1380-71-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1380-74-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1708-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads