darkvnc | 7b844cc75f594f536f486b137817a497407b689725ab45c7904444e82374d4ac

General

Target

idu9A98.exe
Size

2.0MB
MD5

16493223940cd99199a672e44dec05d6
SHA1

ffcde3a96670552d239d547b4c3f44aa77c0fdb7
SHA256

7b844cc75f594f536f486b137817a497407b689725ab45c7904444e82374d4ac
SHA512

5363e507a8d1456dc11747f86cf66113cd85da2d2bd00524b15df24fdeac9f8f1f756c790bcaf9f901c644e4083607185a303c505040115cf0d2b196d6aa4707

Score

10^/10

darkvnc rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/5072-115-0x0000000000AD0000-0x0000000000B5A000-memory.dmp	darkvnc
behavioral2/memory/5072-116-0x0000000000AD17D0-mapping.dmp	darkvnc
behavioral2/memory/5072-118-0x0000000000AD0000-0x0000000000B5A000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 2 IoCs

Processes:

idu9A98.exeidu9A98.exe

description	pid	process	target process
PID 5044 set thread context of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5072 set thread context of 344	5072	idu9A98.exe	WerFault.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

idu9A98.exe

pid process

5044 idu9A98.exe
5044 idu9A98.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

idu9A98.exe

pid process

5072 idu9A98.exe

pid	process
5044	idu9A98.exe
5044	idu9A98.exe

pid	process
5072	idu9A98.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

idu9A98.exeidu9A98.exe

description	pid	process	target process
PID 4648 wrote to memory of 5044	4648	idu9A98.exe	idu9A98.exe
PID 4648 wrote to memory of 5044	4648	idu9A98.exe	idu9A98.exe
PID 4648 wrote to memory of 5044	4648	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe
PID 5044 wrote to memory of 5072	5044	idu9A98.exe	idu9A98.exe

C:\Users\Admin\AppData\Local\Temp\idu9A98.exe
"C:\Users\Admin\AppData\Local\Temp\idu9A98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\idu9A98.exe
  "C:\Users\Admin\AppData\Local\Temp\idu9A98.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Users\Admin\AppData\Local\Temp\idu9A98.exe
    "C:\Users\Admin\AppData\Local\Temp\idu9A98.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    PID:5072
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe
      4⤵
      PID:344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-117-0x0000000000000000-mapping.dmp

Download
memory/344-121-0x00000158B7A80000-0x00000158B7AA9000-memory.dmp

Filesize
164KB

Download
memory/344-120-0x00000158B7B60000-0x00000158B7B61000-memory.dmp

Filesize
4KB

Download
memory/5044-114-0x0000000000000000-mapping.dmp

Download
memory/5072-115-0x0000000000AD0000-0x0000000000B5A000-memory.dmp

Filesize
552KB

Download
memory/5072-116-0x0000000000AD17D0-mapping.dmp

Download
memory/5072-118-0x0000000000AD0000-0x0000000000B5A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads