darkvnc | e1eceb18a899ae4d5ba7080c8e1bc43f11d05a5998e3a6bd41100a23cbc2137a

Analysis

Target

17a966140133ecf3bb64d16d19ab6e6e.exe
Size

417KB
MD5

17a966140133ecf3bb64d16d19ab6e6e
SHA1

bd5c17cd47c677c6d579279befeb1383df8acbc8
SHA256

e1eceb18a899ae4d5ba7080c8e1bc43f11d05a5998e3a6bd41100a23cbc2137a
SHA512

26d0775db7f41d5548d5e5536801c83c3377abcbfde73aaae39691c6d89a735a43357a6c149c44a17063d465949d3721a2ed8c68213c6a4b5ea0e35ed19b86c2

Score

10^/10

darkvnc rat

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1052-62-0x0000000000300000-0x0000000000388000-memory.dmp	darkvnc
behavioral1/memory/1052-63-0x0000000000400000-0x0000000000612000-memory.dmp	darkvnc
behavioral1/memory/1748-65-0x0000000001C40000-0x0000000001D0A000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 1748	1052	17a966140133ecf3bb64d16d19ab6e6e.exe	27

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1052	17a966140133ecf3bb64d16d19ab6e6e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1748	1052	17a966140133ecf3bb64d16d19ab6e6e.exe	27
PID 1052 wrote to memory of 1748	1052	17a966140133ecf3bb64d16d19ab6e6e.exe	27
PID 1052 wrote to memory of 1748	1052	17a966140133ecf3bb64d16d19ab6e6e.exe	27
PID 1052 wrote to memory of 1748	1052	17a966140133ecf3bb64d16d19ab6e6e.exe	27
PID 1052 wrote to memory of 1748	1052	17a966140133ecf3bb64d16d19ab6e6e.exe	27
PID 1052 wrote to memory of 1748	1052	17a966140133ecf3bb64d16d19ab6e6e.exe	27
PID 1052 wrote to memory of 1748	1052	17a966140133ecf3bb64d16d19ab6e6e.exe	27

C:\Users\Admin\AppData\Local\Temp\17a966140133ecf3bb64d16d19ab6e6e.exe
"C:\Users\Admin\AppData\Local\Temp\17a966140133ecf3bb64d16d19ab6e6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe
  2⤵
  PID:1748

memory/1052-59-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/1052-62-0x0000000000300000-0x0000000000388000-memory.dmp

Filesize
544KB

Download
memory/1052-63-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download
memory/1748-61-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

Filesize
8KB

Download
memory/1748-64-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1748-65-0x0000000001C40000-0x0000000001D0A000-memory.dmp

Filesize
808KB

Download