darktrack | 71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

General

Target

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
Size

627KB
MD5

70b5ca289fa630db5715f047212a5403
SHA1

e6e4d63c0be8cbad0517c4ae1a56b1beefac5980
SHA256

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166
SHA512

e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84
SSDEEP

12288:lOqvQomCg4G6q90tmPvj+GU/ttJuqwh3EQiXRUVZs4ixsiNhkApRawx:xoovgbAKvBgtJuqwh3EQihUb1ifNh9

Score

10^/10

darktrack persistence rat stealer

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2488-37-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
C:\Users\Admin\AppData\Roaming\Sys32.exe	family_darktrack
\Users\Admin\AppData\Roaming\Sys32.exe	family_darktrack
\Users\Admin\AppData\Roaming\Sys32.exe	family_darktrack

Executes dropped EXE 1 IoCs

Processes:

Sys32.exe

pid process

2920 Sys32.exe

pid	process
2920	Sys32.exe

Loads dropped DLL 2 IoCs

Processes:

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe

pid	process
2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

notepad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sys32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Sys32.exe"	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Sys32.exe

pid process

2920 Sys32.exe

pid	process
2920	Sys32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exeSys32.exe

description	pid	process	target process
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2744	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	notepad.exe
PID 2488 wrote to memory of 2920	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	Sys32.exe
PID 2488 wrote to memory of 2920	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	Sys32.exe
PID 2488 wrote to memory of 2920	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	Sys32.exe
PID 2488 wrote to memory of 2920	2488	71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe	Sys32.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 2896	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe
PID 2920 wrote to memory of 1668	2920	Sys32.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe
"C:\Users\Admin\AppData\Local\Temp\71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Roaming\Sys32.exe
  "C:\Users\Admin\AppData\Roaming\Sys32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2920
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  PID:2744

C:\Windows\SysWOW64\notepad.exe
notepad
1⤵
- Adds Run key to start application
PID:1668

C:\Windows\SysWOW64\notepad.exe
notepad
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sys32.exe

Filesize
195KB

MD5
e70499513210cb9eb2140abf1288ed33

SHA1
4958bde939aa48d8cbcc914c3cd565bd7614b261

SHA256
62267f676b1e0362e5f7c2fd8f95e00fd7b0d25d1bc14de8cd601cc85c66fdd3

SHA512
c9c9a2d38fdd7f2ac676785837ea545a86c00fd7f24a74122d01d5f754244319a4127785e08a9df9740a8d5edf131fe68e7d5bbd1320996d78b8ca6c5fb98bbd

Download Submit
\Users\Admin\AppData\Roaming\Sys32.exe

Filesize
627KB

MD5
70b5ca289fa630db5715f047212a5403

SHA1
e6e4d63c0be8cbad0517c4ae1a56b1beefac5980

SHA256
71d441f9725ee7a1e158a85e037e2311875f19ad12729900dba14c3ded8c5166

SHA512
e347f690dd54bb48e63a12ba8c63fd7617eafa9b03aea73a4ab107cca3838723bf38a0d3ed36a2e43d3ae6876f26ffd3f27230220fab430f389c90bb2a0aff84

Download Submit
\Users\Admin\AppData\Roaming\Sys32.exe

Filesize
207KB

MD5
a4c76485151ec2ae07318d25046a9f99

SHA1
8102503769d488d84e6d45b1b339e4308f536790

SHA256
50fa9e87b972c84bff3d5b3ab42e01f08de078d648a2037d13057f2f8be9608c

SHA512
9744222ad90fd634ea1a20c7e336f22fe409c587cd23b0e8adbadf4f7bd6c17ac731b1a2125e027034662ccdd8618f70223db72b5223366bac0b198c62234aae

Download Submit
memory/1668-104-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/2488-37-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2744-27-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2744-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads