General

  • Target

    usfive_20210718-142250

  • Size

    472KB

  • Sample

    210718-kzncyldnxn

  • MD5

    c3496df55defe6055694d5f6415bf9ee

  • SHA1

    1d02dd7d82984ad2ae47cab8390059e3f5316649

  • SHA256

    81d0fef5f97170c04985042d646bcf48d541852d047598791bc35c5187262917

  • SHA512

    291152969a90da00d39016e57b64cce7c1a090db5560e3adc4b7faf233857e80d203d12116ecbf884c4b5aa1aab1cf1f64920683a6ecf7b66fa17257dd860714

Malware Config

Targets

    • Target

      usfive_20210718-142250

    • Size

      472KB

    • MD5

      c3496df55defe6055694d5f6415bf9ee

    • SHA1

      1d02dd7d82984ad2ae47cab8390059e3f5316649

    • SHA256

      81d0fef5f97170c04985042d646bcf48d541852d047598791bc35c5187262917

    • SHA512

      291152969a90da00d39016e57b64cce7c1a090db5560e3adc4b7faf233857e80d203d12116ecbf884c4b5aa1aab1cf1f64920683a6ecf7b66fa17257dd860714

    • DarkVNC

      DarkVNC is a malicious version of the famous VNC software.

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • DarkVNC Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks