darthvader | d4b378e5a1ae3e997310e6520bbbf71dc4b31d4f6319be96af2817ededd7a51e

General

Target
d4b378e5a1ae3e997310e6520bbbf71dc4b31d4f6319be96af2817ededd7a51e.dll
Size 955KB
Sample260604-syf2vaav2m
SHA256 d4b378e5a1ae3e997310e6520bbbf71dc4b31d4f6319be96af2817ededd7a51e
MD5 e4907119feb1e33d1378b19977a36c5b
SHA1 e86986c9941af5daca242ab70c1ca563520f7255
SHA512 4140de1573bde01161c18c0588efce4ef156956dba7dd1ba2ddaaba3e585645c8b16bb41cc414d4c52b5bf395d80a0a4db645d67585343ec8baed3aab3c1235f
SSDEEP 12288:9wv2TGLGAFqALAAB/2nZm6kfgiwZ0q2nZm6kfgXLKFqALr3AB:pecABemdfxzmdfb3AB
TLSH
T10D257C0477F8671BE17E8731C2724C2513F6A09356A1C74F4E86E94E2F67782EE066A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware darthvader persistence spyware stealer

Malware Config

Extracted

Family

darthvader

C2

178.156.225.48:4662
135.181.77.225:4662
185.181.208.198:4662

Mutex

Global\RemoteControlClient_0x4ND4R1LH0
Global\MSEdgeUpdateService_0xW4TCHD0G

Attributes

client_dll
skywalker.dll
client_exe
Client.exe
deploy_token
a7f3b9c2e1d4f6a8b0c3d5e7f9a1b2c4
guardian_resource
guardian.bin
schtask_name
MicrosoftEdgeUpdateCheck
servers_file
.svcdns.dat
tor_bundle_url
https://archive.torproject.org/tor-package-archive/torbrowser/15.0.7/tor-expert-bundle-windows-x86_64-15.0.7.tar.gz
watchdog_dll
guardian.dll
web_port
8181

Signatures

Family: DarthVader, SkyWalker
DarthVader aka SkyWalker is a stealer written in C#.
stealer darthvader

Loads dropped DLL 3 IoCs

pid	Process
1652	InstallUtil.exe
1652	InstallUtil.exe
1652	InstallUtil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityMonitor = "regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Telemetry\\SearchProtocol.dll\""	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\rundll32.exe = "11001"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\regsvr32.exe = "1"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\rundll32.exe = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\regsvr32.exe = "0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\rundll32.exe = "0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "11001"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 724	4376	regsvr32.exe	80
PID 4376 wrote to memory of 1652	4376	regsvr32.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d4b378e5a1ae3e997310e6520bbbf71dc4b31d4f6319be96af2817ededd7a51e.dll
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /delete /tn "MicrosoftEdgeUpdateCheck" /f
  2⤵
  PID:724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" /LogFile= /LogToConsole=false "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Telemetry\SearchProtocol.dll"
  2⤵
  - Loads dropped DLL
  PID:1652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SearchProtocol.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Telemetry\SearchProtocol.dll
Size 207KB
SHA256 e0adb1e997263dab177b658eafb1b612114100a39342bc0384f0accb81d58ca3
MD5 a17ca0eaf0c2b3227b329a32030cfdc3
SHA1 68a7a3442a8c21ca2e52885ab18df083ad660ff0
SHA512 b70783e5b57b9b2db6f2a5379ef5e5f77009321ad13a70a1b531e822f2543f191b3ce825335e12ce929341484adef9a2354ea75328ac2d411ae12d3c59687c3e
SSDEEP 3072:X/pm2tQSQ9HFTO5pLAAm+LkmJ/UP4eayLiUbkMenSQ9HFTO5pLAAm+R:RpC9HF6vAAm+LkWNWbkMi9HF6vAAm+
TLSH
T1C3244A0DBFDEE55BEA3C527046A308AB17F090A312F54B0DED860D8A9F1A3C1F95B561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1652-8-0x000001C2433D0000-0x000001C2433DA000-memory.dmp

Download

memory/1652-12-0x000001C243810000-0x000001C24384A000-memory.dmp

Download

memory/1652-14-0x000001C243860000-0x000001C243870000-memory.dmp

Download

memory/1652-15-0x000001C243860000-0x000001C243870000-memory.dmp

Download

memory/4376-0-0x0000000002C50000-0x0000000002C60000-memory.dmp

Download

memory/4376-1-0x000000001CA20000-0x000000001CB16000-memory.dmp

Download

memory/4376-2-0x00007FFD19350000-0x00007FFD19446000-memory.dmp

Download

memory/4376-3-0x0000000002C50000-0x0000000002C60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads