darkvnc | 7b844cc75f594f536f486b137817a497407b689725ab45c7904444e82374d4ac

General

Target

idu9A98.exe
Size

2.0MB
MD5

16493223940cd99199a672e44dec05d6
SHA1

ffcde3a96670552d239d547b4c3f44aa77c0fdb7
SHA256

7b844cc75f594f536f486b137817a497407b689725ab45c7904444e82374d4ac
SHA512

5363e507a8d1456dc11747f86cf66113cd85da2d2bd00524b15df24fdeac9f8f1f756c790bcaf9f901c644e4083607185a303c505040115cf0d2b196d6aa4707

Score

10^/10

darkvnc rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1796-60-0x0000000000CC0000-0x0000000000D4A000-memory.dmp	darkvnc
behavioral1/memory/1796-61-0x0000000000CC17D0-mapping.dmp	darkvnc
behavioral1/memory/1296-66-0x0000000001B90000-0x0000000001C5A000-memory.dmp	darkvnc
behavioral1/memory/1796-64-0x0000000000CC0000-0x0000000000D4A000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 2 IoCs

Processes:

idu9A98.exeidu9A98.exe

description	pid	process	target process
PID 1728 set thread context of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1796 set thread context of 1296	1796	idu9A98.exe	WerFault.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

idu9A98.exe

pid process

1728 idu9A98.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

idu9A98.exe

pid process

1796 idu9A98.exe

pid	process
1728	idu9A98.exe

pid	process
1796	idu9A98.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

idu9A98.exeidu9A98.exe

description	pid	process	target process
PID 1020 wrote to memory of 1728	1020	idu9A98.exe	idu9A98.exe
PID 1020 wrote to memory of 1728	1020	idu9A98.exe	idu9A98.exe
PID 1020 wrote to memory of 1728	1020	idu9A98.exe	idu9A98.exe
PID 1020 wrote to memory of 1728	1020	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe
PID 1728 wrote to memory of 1796	1728	idu9A98.exe	idu9A98.exe

C:\Users\Admin\AppData\Local\Temp\idu9A98.exe
"C:\Users\Admin\AppData\Local\Temp\idu9A98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\idu9A98.exe
  "C:\Users\Admin\AppData\Local\Temp\idu9A98.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\idu9A98.exe
    "C:\Users\Admin\AppData\Local\Temp\idu9A98.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:1796
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe
      4⤵
      PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-62-0x0000000000000000-mapping.dmp

Download
memory/1296-63-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/1296-65-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1296-66-0x0000000001B90000-0x0000000001C5A000-memory.dmp

Filesize
808KB

Download
memory/1728-59-0x0000000000000000-mapping.dmp

Download
memory/1796-60-0x0000000000CC0000-0x0000000000D4A000-memory.dmp

Filesize
552KB

Download
memory/1796-61-0x0000000000CC17D0-mapping.dmp

Download
memory/1796-64-0x0000000000CC0000-0x0000000000D4A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads