Overview
overview
10Static
static
10DarkTrack+...px.exe
windows10-2004-x64
7DarkTrack+...ta.exe
windows10-2004-x64
1DarkTrack+...er.exe
windows10-2004-x64
1DarkTrack+...eg.exe
windows10-2004-x64
1DarkTrack+...e3.dll
windows10-2004-x64
7out.dll
windows10-2004-x64
3DarkTrack+...e3.dll
windows10-2004-x64
3DarkTrack+...er.dll
windows10-2004-x64
7out.dll
windows10-2004-x64
3DarkTrack+...ub.exe
windows10-2004-x64
10Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2023 12:31
Behavioral task
behavioral1
Sample
DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Compressors/upx.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Darktrack 4.1 Beta.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Mescaline File Binder/Mescaline Multi File Binder.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral4
Sample
DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Modules/ffmpeg.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
DarkTrack+Alien+4.1/DarkTrack Alien 4.1/Plugins/sqlite3.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
out.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
out.dll
Resource
win10v2004-20230220-en
General
-
Target
DarkTrack+Alien+4.1/DarkTrack Alien 4.1/sqlite3Reader.dll
-
Size
171KB
-
MD5
744dcc4cbbfbb18fe3878c4e769ec48f
-
SHA1
c1f2c56ee2d91203a01d3465f185295477a1217d
-
SHA256
33eb31a2a576e663474a895ff0190316c64a93d9ce05a55df0d53f9beeb61163
-
SHA512
706630be2ca09e574a7794e32e515a0a3f993643d034647b8cb976c1e7045e87e30362757cc65fcdb95f4a4327f0dcda3edc82ba84e5ed9115870a037e13af21
-
SSDEEP
3072:4yOtgCNPbAHuzueAlwsKmiiEHpmBt7tjBwHH1ELXvSsmB8teUOhKJz4ZKJNCT1xe:FOtRsOz2xKmGH8JBwn+2smB1Uf8Kurb
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral8/memory/1500-133-0x0000000010000000-0x000000001005A000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1448 1500 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3996 wrote to memory of 1500 3996 rundll32.exe rundll32.exe PID 3996 wrote to memory of 1500 3996 rundll32.exe rundll32.exe PID 3996 wrote to memory of 1500 3996 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DarkTrack+Alien+4.1\DarkTrack Alien 4.1\sqlite3Reader.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DarkTrack+Alien+4.1\DarkTrack Alien 4.1\sqlite3Reader.dll",#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1500 -ip 15001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-133-0x0000000010000000-0x000000001005A000-memory.dmpFilesize
360KB