darkvnc | 5895164454aba620b70384013953a9e1e8e0b90166bd5fb849275e42071f0025

Analysis

Target

mixazed_20210816-170249.exe
Size

513KB
MD5

a79c261f6fae161ede7489db34ca3813
SHA1

c2d6bb13082a20c0fe6a97d49a01d5f39355e952
SHA256

5895164454aba620b70384013953a9e1e8e0b90166bd5fb849275e42071f0025
SHA512

6097dd911f5ca54e7df4281bae393b0a91abf601a89af33b726e177855c7060045db843763b9dff147b589cbf67a3daddf8b584a9f7adb340da377ce089c80a7

Score

10^/10

darkvnc rat

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2680 created 3624	2680	WerFault.exe	68

DarkVNC Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3624-116-0x0000000000400000-0x0000000000937000-memory.dmp	darkvnc
behavioral2/memory/2612-119-0x000001B588D90000-0x000001B588F39000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3624 set thread context of 2612	3624	mixazed_20210816-170249.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	3624	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3624	mixazed_20210816-170249.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2612	3624	mixazed_20210816-170249.exe	76
PID 3624 wrote to memory of 2612	3624	mixazed_20210816-170249.exe	76
PID 3624 wrote to memory of 2612	3624	mixazed_20210816-170249.exe	76
PID 3624 wrote to memory of 2612	3624	mixazed_20210816-170249.exe	76
PID 3624 wrote to memory of 2612	3624	mixazed_20210816-170249.exe	76

C:\Users\Admin\AppData\Local\Temp\mixazed_20210816-170249.exe
"C:\Users\Admin\AppData\Local\Temp\mixazed_20210816-170249.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe
  2⤵
  PID:2612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 496
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680

memory/2612-118-0x000001B588B20000-0x000001B588B21000-memory.dmp

Filesize
4KB

Download
memory/2612-119-0x000001B588D90000-0x000001B588F39000-memory.dmp

Filesize
1.7MB

Download
memory/3624-116-0x0000000000400000-0x0000000000937000-memory.dmp

Filesize
5.2MB

Download
memory/3624-115-0x00000000009D0000-0x0000000000B1A000-memory.dmp

Filesize
1.3MB

Download