Overview

overview

10

Static

static

3

.pdf.exe

windows7-x64

8

.pdf.exe

windows10-2004-x64

10

⌚/Morty.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    .pdf.exe

  • Size

    159KB

  • Sample

    241011-htmzgs1bkg

  • MD5

    b388dc8131fd81f81576fb3c1ec2e891

  • SHA1

    759036faa3e742fb30bf7d35c9b991fcba2def2e

  • SHA256

    8eadd27519eb9a97959c7417696f906ce4de01e49e1321a466a2748e888db2a5

  • SHA512

    937dd35e4c8461d6ebf2c2e941d7a9b817426375cba0eece3db99660ed7baea038f9bcd30a592944f88b225969ca1e730a3db03c43e2ac2dd847d6593e21b6e0

  • SSDEEP

    3072:8nPdzuK8Jdw4TMJw3uuXKpgKVObvguaMvQZWNl/27EmQcOghmrbmpTcs/Sjq:8nPdudwDHpgD4uaUlkEmQcpzpwsN

Score
10/10
darktrackdiscoveryexecutionpersistenceratstealer

Malware Config

Targets

    • Target

      .pdf.exe

    • Size

      159KB

    • MD5

      b388dc8131fd81f81576fb3c1ec2e891

    • SHA1

      759036faa3e742fb30bf7d35c9b991fcba2def2e

    • SHA256

      8eadd27519eb9a97959c7417696f906ce4de01e49e1321a466a2748e888db2a5

    • SHA512

      937dd35e4c8461d6ebf2c2e941d7a9b817426375cba0eece3db99660ed7baea038f9bcd30a592944f88b225969ca1e730a3db03c43e2ac2dd847d6593e21b6e0

    • SSDEEP

      3072:8nPdzuK8Jdw4TMJw3uuXKpgKVObvguaMvQZWNl/27EmQcOghmrbmpTcs/Sjq:8nPdudwDHpgD4uaUlkEmQcpzpwsN

    Score
    10/10
    discoveryexecutionpersistencedarktrackratstealer

    • DarkTrack

      DarkTrack is a remote administration tool written in delphi.

      ratstealerdarktrack

    • DarkTrack payload

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      ⌚/Morty.exe

    • Size

      1.7MB

    • MD5

      7fb0379bab9c95df45522c529a4a6c40

    • SHA1

      75884061e4b1be342a8ad93d40913854695e412a

    • SHA256

      998b564aea4c6a60da1df9b66e05a7d15fa12421433f9fa712f3d65ace4cee6a

    • SHA512

      9058b6f89d706b51331a98c7b254f3f0a1dcf472ee9d7a23f134793ccb201f67e818ab084ca34f78909ffecfa366d2d570014ac805e35fb3a5a22fe7d7bae97e

    • SSDEEP

      3072:EahKyd2n31Y5vWp1icKAArDZz4N9GhbkENEk3bkbd:EahO1p0yN90vE/d

    Score
    1/10
    behavioral3

MITRE ATT&CK Enterprise v15

Tasks