b33fc886beea76f9d9fef4a7d3ed6c3fb7d92916406dab494407a68875e295bc

General

Target
Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe
Size 559KB
Sample260804-3fk8ystakh
SHA256 b33fc886beea76f9d9fef4a7d3ed6c3fb7d92916406dab494407a68875e295bc
MD5 77feaac69ff95168e5d9dfdbc9c414f9
SHA1 7a1062ef3e06cf7ff5d0f899c3620726590cc0c6
SHA512 71e56afd1de554285fb064d8fe1b2f41f93fc3acc6409591655331e38ed2ef0c06d7f59612c50b90f6c4c400132269188741234efd50a3a995a858254adb461d
SSDEEP 6144:NATZN84Aw1zs+NsSrSgZrWs+H0rRahO2qbUqev/nkCuIf68KOEUyV1fETKKXE4Uy:NYDB1zNzrpw0QybE/knIfgOrW1cTKkP
TLSH
T186C46D36A79402FCE1ABD179CE424D06E772784917B09ADF17E046A21F276E05F3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4432	netsh.exe
3708	netsh.exe
2912	netsh.exe
2200	netsh.exe
1624	netsh.exe
6024	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
980	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe
3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4432	3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe	90
PID 3036 wrote to memory of 3708	3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe	92
PID 3036 wrote to memory of 2912	3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe	94
PID 3036 wrote to memory of 2200	3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe	96
PID 3036 wrote to memory of 1624	3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe	98
PID 3036 wrote to memory of 6024	3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe	100
PID 3036 wrote to memory of 980	3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe	102
PID 3036 wrote to memory of 3372	3036	Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe	104

C:\Users\Admin\AppData\Local\Temp\Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe
"C:\Users\Admin\AppData\Local\Temp\Luckyware _ DarkSideRAT FUCKER KILLBYTE.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall show rule name="LUCKYWARE_BLOCK_91.92.243.218"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4432
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="LUCKYWARE_BLOCK_91.92.243.218_OUT" dir=out action=block remoteip=91.92.243.218
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3708
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="LUCKYWARE_BLOCK_91.92.243.218_IN" dir=in action=block remoteip=91.92.243.218
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2912
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall show rule name="LUCKYWARE_BLOCK_188.114.96.11"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2200
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="LUCKYWARE_BLOCK_188.114.96.11_OUT" dir=out action=block remoteip=188.114.96.11
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1624
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="LUCKYWARE_BLOCK_188.114.96.11_IN" dir=in action=block remoteip=188.114.96.11
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6024
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:980
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /fo CSV /v > "C:\Users\Admin\AppData\Local\Temp\luckaware_tasks.txt" 2>nul
  2⤵
  PID:3372