darkvnc | e5645c71f642f457348025cca404a3e756f91b0ae418cebae622935cea1707f6

Analysis

Target

zdnDE6F.tmp.dll
Size

1.3MB
MD5

108b97c82934dd23e8d7cd9534ad2685
SHA1

991d8933b8afe85c743321050c63c34dad9eb69a
SHA256

e5645c71f642f457348025cca404a3e756f91b0ae418cebae622935cea1707f6
SHA512

0e902f5e0a34326e14d1df413265fa3057094091897b4e3c3e7e34eec511cfbdf9d99b4a9c1efc537f0ea977c0bcc38683fff9cbb4acb6a25e680c9c0931e0fc

Score

10^/10

darkvnc rat

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1652-116-0x0000000073DF0000-0x0000000073FD7000-memory.dmp	darkvnc
behavioral2/memory/1652-115-0x0000000073DF0000-0x0000000073E7A000-memory.dmp	darkvnc
behavioral2/memory/2044-120-0x000001FB9CDC0000-0x000001FB9CE8A000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 2044	1652	rundll32.exe	79

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1652	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1652	632	rundll32.exe	71
PID 632 wrote to memory of 1652	632	rundll32.exe	71
PID 632 wrote to memory of 1652	632	rundll32.exe	71
PID 1652 wrote to memory of 2044	1652	rundll32.exe	79
PID 1652 wrote to memory of 2044	1652	rundll32.exe	79
PID 1652 wrote to memory of 2044	1652	rundll32.exe	79
PID 1652 wrote to memory of 2044	1652	rundll32.exe	79
PID 1652 wrote to memory of 2044	1652	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zdnDE6F.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zdnDE6F.tmp.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe
    3⤵
    PID:2044

memory/1652-116-0x0000000073DF0000-0x0000000073FD7000-memory.dmp

Filesize
1.9MB

Download
memory/1652-115-0x0000000073DF0000-0x0000000073E7A000-memory.dmp

Filesize
552KB

Download
memory/1652-118-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/2044-120-0x000001FB9CDC0000-0x000001FB9CE8A000-memory.dmp

Filesize
808KB

Download
memory/2044-119-0x000001FB9CC70000-0x000001FB9CC99000-memory.dmp

Filesize
164KB

Download