darthvader | d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2

General

Target
d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2.dll
Size 980KB
Sample260604-syf2vaav2n
SHA256 d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2
MD5 0026bfe4a7284b9f3ac9edd25ec377f4
SHA1 b359c3115e726a6b930ee2a45345b5f4bfcb454b
SHA512 71cc08437736c2de0781cebdf01acc261f07ea9283a204d965ba2d0148df6a41546b2e328e8ebc83c2ec967e16cd47e2d33d34ebf80af40355d478c1bdc94967
SSDEEP 12288:Mwv2YvL4QF3J9KBDnBxEIowZ0CnBxEIukXLnF3JeKB:AY9DKB7BiPABioBQKB
TLSH
T1C4258D0477F8671BE17E8731C2725C2913F2A05356A1C74F4E86E94E2F67782EE066A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware darthvader persistence spyware stealer

Malware Config

Extracted

Family

darthvader

C2

178.156.225.48:4662
135.181.77.225:4662
185.181.208.198:4662

Mutex

Global\RemoteControlClient_0x4ND4R1LH0
Global\MSEdgeUpdateService_0xW4TCHD0G

Attributes

client_dll
skywalker.dll
client_exe
Client.exe
deploy_token
a7f3b9c2e1d4f6a8b0c3d5e7f9a1b2c4
guardian_resource
guardian.bin
schtask_name
MicrosoftEdgeUpdateCheck
servers_file
.svcdns.dat
tor_bundle_url
https://archive.torproject.org/tor-package-archive/torbrowser/15.0.7/tor-expert-bundle-windows-x86_64-15.0.7.tar.gz
watchdog_dll
guardian.dll
web_port
8181

Signatures

Family: DarthVader, SkyWalker
DarthVader aka SkyWalker is a stealer written in C#.
stealer darthvader

Loads dropped DLL 6 IoCs

pid	Process
5412	InstallUtil.exe
5412	InstallUtil.exe
5412	InstallUtil.exe
5312	rundll32.exe
5312	rundll32.exe
5312	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeTelemetry = "\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe\" /LogFile= /LogToConsole=false \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Security\\Plugins\\smartscreen.dll\""	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\regsvr32.exe = "1"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\rundll32.exe = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\regsvr32.exe = "0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\rundll32.exe = "0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "11001"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\rundll32.exe = "11001"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 3324	2708	regsvr32.exe	79
PID 2708 wrote to memory of 5312	2708	regsvr32.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2.dll
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /delete /tn "MicrosoftEdgeUpdateCheck" /f
  2⤵
  PID:3324
- C:\Windows\system32\rundll32.exe
  "rundll32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Plugins\smartscreen.dll",Entry
  2⤵
  - Loads dropped DLL
  PID:5312

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" /LogFile= /LogToConsole=false "C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Plugins\smartscreen.dll"
1⤵
- Loads dropped DLL
PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smartscreen.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Plugins\smartscreen.dll
Size 217KB
SHA256 f865641c22e75cbb9ee5fe3c37470ce0e127a98aab6f54fc3cf8753e5187b0ac
MD5 7bd550bc18faac64ad256d165d90cfed
SHA1 372eab0ae478805297aa0b9fffcd8109366c3a58
SHA512 1664e82d940f12083dafac227d4194e424212c474d8c39a928c2b9771b5ae620abd9c774f314ca4fde89ea64cf54e1a271cd76c25e5eed9dfd5671e4ae47b900
SSDEEP 6144:JBvo9HFocum+VobvaGzOx4c4l9HFocum+w:EFvqkagOxEFvqw
TLSH
T1B6245A0CBFDDF85BE93D167186A3086B13F0806316F58B0DAE860D9E9F1A3C2BD56561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2708-0-0x0000000002180000-0x0000000002190000-memory.dmp

Download

memory/2708-1-0x000000001C170000-0x000000001C26C000-memory.dmp

Download

memory/2708-2-0x00007FFB6DD20000-0x00007FFB6DE1C000-memory.dmp

Download

memory/2708-3-0x0000000002180000-0x0000000002190000-memory.dmp

Download

memory/5312-18-0x00007FFB76660000-0x00007FFB7669E000-memory.dmp

Download

memory/5412-8-0x0000015002F80000-0x0000015002F8A000-memory.dmp

Download

memory/5412-12-0x0000015003410000-0x000001500344E000-memory.dmp

Download

memory/5412-14-0x000001501EB40000-0x000001501EB50000-memory.dmp

Download

memory/5412-20-0x000001501EB40000-0x000001501EB50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads