Analysis
- max time kernel
171s - max time network
175s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
02/05/2022, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe
- Size 772KB
- Sample220502-xcmpqadch8
- SHA256 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245
- MD5 788b015ff15332bea73361bbc41fdda0
- SHA1 cb0691054443686d034a0a3d47e57e2afee52830
- SHA512 13d4d74b99b3b28cbeae2f13a69c873a085217f01c2e361583f8ffb8e8aa95dbe4b3d804d48a4cba4bb73b7c5417fab52f71b2759c006a3d87e4f75ae6224633
- MD5 SHA1 SHA512
Malware Config
Signatures
- DarkTrack Payload 4 IoCs
resource yara_rule behavioral2/memory/4724-133-0x0000000000400000-0x00000000004A8000-memory.dmp family_darktrack behavioral2/memory/4724-134-0x0000000000400000-0x00000000004A8000-memory.dmp family_darktrack behavioral2/memory/4724-135-0x0000000000400000-0x00000000004A8000-memory.dmp family_darktrack behavioral2/memory/4724-137-0x0000000000400000-0x00000000004A8000-memory.dmp family_darktrack - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4292 set thread context of 5020 4292 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 87 PID 5020 set thread context of 4556 5020 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 88 PID 4556 set thread context of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4292 wrote to memory of 5020 4292 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 87 PID 4292 wrote to memory of 5020 4292 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 87 PID 4292 wrote to memory of 5020 4292 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 87 PID 5020 wrote to memory of 4556 5020 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 88 PID 5020 wrote to memory of 4556 5020 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 88 PID 5020 wrote to memory of 4556 5020 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 88 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4556 wrote to memory of 4724 4556 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 93 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95 PID 4724 wrote to memory of 1456 4724 1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"C:\Users\Admin\AppData\Local\Temp\1d578911549a00273c5ac5e3bdf19bc32c9ca7bbab7c7f4476235dc41e671245.exe"4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:1456
-
-
-
-