darkvnc | e1eceb18a899ae4d5ba7080c8e1bc43f11d05a5998e3a6bd41100a23cbc2137a

Analysis

Target

17a966140133ecf3bb64d16d19ab6e6e.exe
Size

417KB
MD5

17a966140133ecf3bb64d16d19ab6e6e
SHA1

bd5c17cd47c677c6d579279befeb1383df8acbc8
SHA256

e1eceb18a899ae4d5ba7080c8e1bc43f11d05a5998e3a6bd41100a23cbc2137a
SHA512

26d0775db7f41d5548d5e5536801c83c3377abcbfde73aaae39691c6d89a735a43357a6c149c44a17063d465949d3721a2ed8c68213c6a4b5ea0e35ed19b86c2

Score

10^/10

darkvnc rat

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2796 created 3876	2796	WerFault.exe	47

DarkVNC Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3876-114-0x0000000000A80000-0x0000000000B08000-memory.dmp	darkvnc
behavioral2/memory/3876-116-0x0000000000400000-0x0000000000612000-memory.dmp	darkvnc
behavioral2/memory/2176-118-0x0000017CAE620000-0x0000017CAE6EA000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3876 set thread context of 2176	3876	17a966140133ecf3bb64d16d19ab6e6e.exe	75

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	3876	WerFault.exe	47

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3876	17a966140133ecf3bb64d16d19ab6e6e.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 2176	3876	17a966140133ecf3bb64d16d19ab6e6e.exe	75
PID 3876 wrote to memory of 2176	3876	17a966140133ecf3bb64d16d19ab6e6e.exe	75
PID 3876 wrote to memory of 2176	3876	17a966140133ecf3bb64d16d19ab6e6e.exe	75
PID 3876 wrote to memory of 2176	3876	17a966140133ecf3bb64d16d19ab6e6e.exe	75
PID 3876 wrote to memory of 2176	3876	17a966140133ecf3bb64d16d19ab6e6e.exe	75

C:\Users\Admin\AppData\Local\Temp\17a966140133ecf3bb64d16d19ab6e6e.exe
"C:\Users\Admin\AppData\Local\Temp\17a966140133ecf3bb64d16d19ab6e6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe
  2⤵
  PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 508
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796

memory/2176-117-0x0000017CAE3F0000-0x0000017CAE419000-memory.dmp

Filesize
164KB

Download
memory/2176-118-0x0000017CAE620000-0x0000017CAE6EA000-memory.dmp

Filesize
808KB

Download
memory/3876-114-0x0000000000A80000-0x0000000000B08000-memory.dmp

Filesize
544KB

Download
memory/3876-116-0x0000000000400000-0x0000000000612000-memory.dmp

Filesize
2.1MB

Download