Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
19/11/2025, 11:57
General
- Target 1.exe
- Size 33.2MB
- Sample251119-n4phystmcj
- SHA256 bbbc2a56ba69aefa567dbffe1982e21c7317e305741f7027cd0975c4bf79f8df
Malware Config
Extracted
-
darktrack
-
wwwyandex.org:112233
Signatures
- DarkTrack
DarkTrack is a remote administration tool written in delphi.
- DarkTrack payload 2 IoCs
- Darktrack family
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2808-0-0x0000000000210000-0x0000000002342000-memory.dmp
memory/2808-1-0x0000000007150000-0x00000000076F6000-memory.dmp
memory/2808-2-0x0000000006D20000-0x0000000006E4C000-memory.dmp
memory/2808-34-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-8-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-3-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-44-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-62-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-61-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-58-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-56-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-52-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-50-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-48-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-46-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-42-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-40-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-39-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-36-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-32-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-30-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-28-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-26-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-24-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-22-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-20-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-18-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-16-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-14-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-12-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-10-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-6-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-4-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-54-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-96-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-88-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-98-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-118-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-128-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-126-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-124-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-122-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-120-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-116-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-114-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-112-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-110-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-108-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-106-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-104-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-103-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-100-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-94-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-92-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-90-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-86-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-82-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-80-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-78-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-76-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-75-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-72-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-70-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-68-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-66-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-84-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-64-0x0000000006D20000-0x0000000006E47000-memory.dmp
memory/2808-2059-0x0000000006C80000-0x0000000006C90000-memory.dmp
memory/2808-2060-0x0000000006E60000-0x0000000006EEE000-memory.dmp
memory/2808-2061-0x0000000006F00000-0x0000000006F4C000-memory.dmp
memory/2808-2062-0x0000000006C80000-0x0000000006C90000-memory.dmp
memory/3888-2066-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/3888-2072-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/3888-2071-0x0000000004C90000-0x0000000004C91000-memory.dmp
memory/3888-2073-0x0000000000400000-0x00000000004A8000-memory.dmp