Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
19/11/2025, 11:57
General
- Target 1.exe
- Size 33.2MB
- Sample251119-n4phystmcj
- SHA256 bbbc2a56ba69aefa567dbffe1982e21c7317e305741f7027cd0975c4bf79f8df
Malware Config
Signatures
- DarkTrack
DarkTrack is a remote administration tool written in delphi.
- Darktrack family
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2924-2083-0x0000000002A80000-0x0000000002A81000-memory.dmp
memory/2924-2082-0x0000000002A90000-0x0000000002A91000-memory.dmp
memory/3264-2081-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/3756-0-0x0000000000E90000-0x0000000002FC2000-memory.dmp
memory/3756-1-0x0000000007E50000-0x00000000083F4000-memory.dmp
memory/3756-2-0x0000000007AF0000-0x0000000007C1C000-memory.dmp
memory/3756-3-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-22-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-62-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-82-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-84-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-80-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-78-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-76-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-74-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-73-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-70-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-68-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-66-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-64-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-60-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-58-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-56-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-54-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-52-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-50-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-48-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-46-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-44-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-42-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-40-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-38-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-36-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-34-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-30-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-28-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-26-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-24-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-20-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-18-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-16-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-14-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-12-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-10-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-8-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-6-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-4-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-32-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-98-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-110-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-128-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-122-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-120-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-118-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-116-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-114-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-113-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-108-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-106-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-104-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-102-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-100-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-96-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-92-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-88-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-126-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-124-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-94-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-90-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-86-0x0000000007AF0000-0x0000000007C17000-memory.dmp
memory/3756-2059-0x0000000007A10000-0x0000000007A20000-memory.dmp
memory/3756-2060-0x0000000007C80000-0x0000000007D0E000-memory.dmp
memory/3756-2061-0x0000000007A20000-0x0000000007A6C000-memory.dmp
memory/3756-2062-0x0000000007A10000-0x0000000007A20000-memory.dmp