Overview

overview

10

Static

static

3a9397af4d...4b.exe

windows7_x64

10

3a9397af4d...4b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294183s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    28-03-2022 15:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe

  • Size

    670KB

  • MD5

    cebad7507c9b80980e1f6d9f829a7e41

  • SHA1

    21a3b8876d3ed54da07825f9696bfb5597c47439

  • SHA256

    3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b

  • SHA512

    5406f08f884584b88df81e3968b9dc37eb3cf4bccfb3d84dffedb7a421a8166f616d9c0b9d036067a06ac5ae59f3141974ee9759a8df18ebb29e2a618bea5bab

Score
10/10
darkvncratsuricata

Malware Config

Signatures

  • DarkVNC

    DarkVNC is a malicious version of the famous VNC software.

    ratdarkvnc
  • suricata: ET MALWARE VNCStartServer BOT Variant CnC Beacon

    suricata: ET MALWARE VNCStartServer BOT Variant CnC Beacon

    suricata
  • suricata: ET MALWARE VNCStartServer USR Variant CnC Beacon

    suricata: ET MALWARE VNCStartServer USR Variant CnC Beacon

    suricata
  • DarkVNC Payload 2 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe
    "C:\Users\Admin\AppData\Local\Temp\3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe
      2⤵
        PID:2000

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1704-54-0x00000000750C1000-0x00000000750C3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1704-55-0x0000000002580000-0x0000000002B10000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/1704-56-0x0000000000400000-0x00000000004AD000-memory.dmp
      Filesize

      692KB

      Download
    • memory/1704-59-0x0000000010000000-0x0000000010089000-memory.dmp
      Filesize

      548KB

      Download
    • memory/1704-63-0x0000000000400000-0x00000000004AD000-memory.dmp
      Filesize

      692KB

      Download
    • memory/1704-64-0x00000000030C0000-0x0000000003200000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/2000-62-0x0000000000000000-mapping.dmp
      Download