Overview

overview

10

Static

static

10

71d441f972...66.exe

windows7-x64

10

71d441f972...66.exe

windows10-2004-x64

10

Resubmissions

26-12-2023 07:36

231226-jfrwysdhh8 10

28-02-2021 07:18

210228-gg2156g8fe 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

  • Size

    627KB

  • Sample

    231226-jfrwysdhh8

  • MD5

    70b5ca289fa630db5715f047212a5403

  • SHA1

    e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

  • SHA256

    71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

  • SHA512

    e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

  • SSDEEP

    12288:lOqvQomCg4G6q90tmPvj+GU/ttJuqwh3EQiXRUVZs4ixsiNhkApRawx:xoovgbAKvBgtJuqwh3EQihUb1ifNh9

Score
10/10
darktrackpersistenceratstealer

Malware Config

Targets

    • Target

      71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

    • Size

      627KB

    • MD5

      70b5ca289fa630db5715f047212a5403

    • SHA1

      e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

    • SHA256

      71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

    • SHA512

      e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

    • SSDEEP

      12288:lOqvQomCg4G6q90tmPvj+GU/ttJuqwh3EQiXRUVZs4ixsiNhkApRawx:xoovgbAKvBgtJuqwh3EQihUb1ifNh9

    Score
    10/10
    darktrackpersistenceratstealer

    • DarkTrack

      DarkTrack is a remote administration tool written in delphi.

      ratstealerdarktrack

    • DarkTrack payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks