darthvader | d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2

General

Target
d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2.dll
Size 980KB
Sample260604-syf2vaav2n
SHA256 d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2
MD5 0026bfe4a7284b9f3ac9edd25ec377f4
SHA1 b359c3115e726a6b930ee2a45345b5f4bfcb454b
SHA512 71cc08437736c2de0781cebdf01acc261f07ea9283a204d965ba2d0148df6a41546b2e328e8ebc83c2ec967e16cd47e2d33d34ebf80af40355d478c1bdc94967
SSDEEP 12288:Mwv2YvL4QF3J9KBDnBxEIowZ0CnBxEIukXLnF3JeKB:AY9DKB7BiPABioBQKB
TLSH
T1C4258D0477F8671BE17E8731C2725C2913F2A05356A1C74F4E86E94E2F67782EE066A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware darthvader persistence spyware stealer

Malware Config

Extracted

Family

darthvader

C2

178.156.225.48:4662
135.181.77.225:4662
185.181.208.198:4662

Mutex

Global\RemoteControlClient_0x4ND4R1LH0
Global\MSEdgeUpdateService_0xW4TCHD0G

Attributes

client_dll
skywalker.dll
client_exe
Client.exe
deploy_token
a7f3b9c2e1d4f6a8b0c3d5e7f9a1b2c4
guardian_resource
guardian.bin
schtask_name
MicrosoftEdgeUpdateCheck
servers_file
.svcdns.dat
tor_bundle_url
https://archive.torproject.org/tor-package-archive/torbrowser/15.0.7/tor-expert-bundle-windows-x86_64-15.0.7.tar.gz
watchdog_dll
guardian.dll
web_port
8181

Signatures

Family: DarthVader, SkyWalker
DarthVader aka SkyWalker is a stealer written in C#.
stealer darthvader

Loads dropped DLL 3 IoCs

pid	Process
772	rundll32.exe
772	rundll32.exe
772	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsProtectionService = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Security\\Plugins\\MpCmdRun.dll\",Entry"	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\regsvr32.exe = "1"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\rundll32.exe = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\regsvr32.exe = "0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\rundll32.exe = "0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "11001"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\rundll32.exe = "11001"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4328	3040	regsvr32.exe	106
PID 3040 wrote to memory of 772	3040	regsvr32.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2.dll
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /delete /tn "MicrosoftEdgeUpdateCheck" /f
  2⤵
  PID:4328
- C:\Windows\system32\rundll32.exe
  "rundll32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Plugins\MpCmdRun.dll",Entry
  2⤵
  - Loads dropped DLL
  PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MpCmdRun.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Plugins\MpCmdRun.dll
Size 217KB
SHA256 f865641c22e75cbb9ee5fe3c37470ce0e127a98aab6f54fc3cf8753e5187b0ac
MD5 7bd550bc18faac64ad256d165d90cfed
SHA1 372eab0ae478805297aa0b9fffcd8109366c3a58
SHA512 1664e82d940f12083dafac227d4194e424212c474d8c39a928c2b9771b5ae620abd9c774f314ca4fde89ea64cf54e1a271cd76c25e5eed9dfd5671e4ae47b900
SSDEEP 6144:JBvo9HFocum+VobvaGzOx4c4l9HFocum+w:EFvqkagOxEFvqw
TLSH
T1B6245A0CBFDDF85BE93D167186A3086B13F0806316F58B0DAE860D9E9F1A3C2BD56561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/772-10-0x000001A5AEEE0000-0x000001A5AEEF0000-memory.dmp

Download

memory/772-14-0x00007FF91CB40000-0x00007FF91CB7E000-memory.dmp

Download

memory/772-13-0x000001A5B0720000-0x000001A5B075E000-memory.dmp

Download

memory/772-15-0x000001A5AEEE0000-0x000001A5AEEF0000-memory.dmp

Download

memory/3040-0-0x0000000000880000-0x0000000000890000-memory.dmp

Download

memory/3040-1-0x000000001AB20000-0x000000001AC1C000-memory.dmp

Download

memory/3040-2-0x00007FF90E910000-0x00007FF90EA0C000-memory.dmp

Download

memory/3040-3-0x0000000000880000-0x0000000000890000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads