darktrack

General

Target

Копия трудовой.docx.rar
Size

1.6MB
Sample

240625-pre97ashqk
MD5

b59daecdced977f6cbb3cb45439872de
SHA1

7ba7bcc5df967864295766e4a21a01994143a08a
SHA256

fb28ec498a67d1cf4ebcbb358d1cad0ab86eada614198bdd5dfe3c61e464c1e7
SHA512

9b1f9d18866af6a26dd5fb14a7e3aa5f620a51340e7444ddaeb4e570f1e5fae3a1abf18978b0f0190bdb3105c979e4d3e2663e8b2a3af050dc344b5a9b521a29
SSDEEP

49152:FSA0WK/rpRbvUd3mF3i8+OjrHNap6T00j6l9qsshN6:FSA0x/rpRwwF3i8+wrHNTE3qRN6

Score

10^/10

Malware Config

Targets

- Target
  
  Копия трудовой.docx.rar
- Size
  
  1.6MB
- MD5
  
  b59daecdced977f6cbb3cb45439872de
- SHA1
  
  7ba7bcc5df967864295766e4a21a01994143a08a
- SHA256
  
  fb28ec498a67d1cf4ebcbb358d1cad0ab86eada614198bdd5dfe3c61e464c1e7
- SHA512
  
  9b1f9d18866af6a26dd5fb14a7e3aa5f620a51340e7444ddaeb4e570f1e5fae3a1abf18978b0f0190bdb3105c979e4d3e2663e8b2a3af050dc344b5a9b521a29
- SSDEEP
  
  49152:FSA0WK/rpRbvUd3mF3i8+OjrHNap6T00j6l9qsshN6:FSA0x/rpRwwF3i8+wrHNTE3qRN6
Score

3^/10
behavioral1 behavioral2
- Target
  
  Копия трудовой.docx.exe
- Size
  
  1.8MB
- MD5
  
  6a5cb8007261d0ef578c02de549e5b6f
- SHA1
  
  f14a1505471dd77efc07cfcfd4e5248fce09d495
- SHA256
  
  60414e88a21df60b0caccdf498b41aa7c75c10d880ab61a620f5b13ba2faebd1
- SHA512
  
  10488946d37ab1935c648f532f223ec4bc4d15f8f94065509dc41aff77f671224403b720bb31743df44c3dee17c2326e8bc479d67c9355e0b0ff910c776380e4
- SSDEEP
  
  49152:DjfldAdiiAojFrHLsPazEzHEOtkwTfljaRRsjHyTpo3D:Db8diiXBrHL2a8HnTNjarsjHQM
Score

8^/10

execution persistence
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  
  $TEMP/Copy_trydovoj.docx
- Size
  
  1.5MB
- MD5
  
  789497a9ff0bd7df99aa662f512c6856
- SHA1
  
  f69cec1046f8e59983fd8cfcae867926495fadd6
- SHA256
  
  8646226f4b2b2b96d5e31d4daae0ac5484edc2a7759297e0f63a06358ea61a38
- SHA512
  
  71442dec98b3ec16f94ec07380087370c72a48532398f893a9324081f7560f7c620b549770b97356fe5400f6ef7e4935b6339d477298be13966c06f1f5065205
- SSDEEP
  
  49152:H+mxBf5HVPjLYdqN5/11ybKbzM1yZyidw0V5Ufzpct/rmmrx:ljRVPhN5/11ybazXIDlQbx
Score

4^/10
behavioral5 behavioral6
- Target
  
  $TEMP/putin_hyilo.exe
- Size
  
  176KB
- MD5
  
  df5671afa8a8170a515c589e1b342d52
- SHA1
  
  ae327ecd6f312f5860fe35bacfa36cb9768852bb
- SHA256
  
  6e9d23e7b4a677651ccb362fa6833ca13deef184a45a801cb1d7d1f542210809
- SHA512
  
  156499f5e8a28206450e5946d26e12b3da589fb8972cdb85a2beef6f09943f8de5f40938ed402cbe661f4a3c24554f807755c29d2ef8b2a083c5e86d2faf108b
- SSDEEP
  
  3072:yHwrxmMpvDITZg1Sa5GWp1icKAArDZz4N9GhbkrNEk1RIir:trMZ0p0yN90QEeIq
Score

10^/10

darktrack execution persistence rat stealer upx
- DarkTrack
  DarkTrack is a remote administration tool written in delphi.
  rat stealer darktrack
- DarkTrack payload
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral7