General
-
Target
e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26
-
Size
822KB
-
Sample
220512-n3mmzagcar
-
MD5
4e7cf999557893b08c6623c31c45b28d
-
SHA1
9f8a085de74277fe2fcd79d77037a0627b79ebc1
-
SHA256
e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26
-
SHA512
44711a040f3b5329d71b6f0fec1dd21adf16626ffacde92b28603b8358f81f9b8e76f68610629be9a62051273f14396ba7cd24eb87f89a60bca5260f8e337ef8
Static task
static1
Behavioral task
behavioral1
Sample
e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26
-
Size
822KB
-
MD5
4e7cf999557893b08c6623c31c45b28d
-
SHA1
9f8a085de74277fe2fcd79d77037a0627b79ebc1
-
SHA256
e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26
-
SHA512
44711a040f3b5329d71b6f0fec1dd21adf16626ffacde92b28603b8358f81f9b8e76f68610629be9a62051273f14396ba7cd24eb87f89a60bca5260f8e337ef8
-
DarkTrack Payload
-
Modifies WinLogon for persistence
-
Turns off Windows Defender SpyNet reporting
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-