darkvnc | 3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b

General

Target

3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe
Size

670KB
MD5

cebad7507c9b80980e1f6d9f829a7e41
SHA1

21a3b8876d3ed54da07825f9696bfb5597c47439
SHA256

3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b
SHA512

5406f08f884584b88df81e3968b9dc37eb3cf4bccfb3d84dffedb7a421a8166f616d9c0b9d036067a06ac5ae59f3141974ee9759a8df18ebb29e2a618bea5bab

Score

10^/10

darkvnc rat suricata

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc
suricata: ET MALWARE VNCStartServer BOT Variant CnC Beacon
suricata: ET MALWARE VNCStartServer BOT Variant CnC Beacon
suricata
suricata: ET MALWARE VNCStartServer USR Variant CnC Beacon
suricata: ET MALWARE VNCStartServer USR Variant CnC Beacon
suricata

DarkVNC Payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1704-59-0x0000000010000000-0x0000000010089000-memory.dmp	darkvnc
behavioral1/memory/1704-64-0x00000000030C0000-0x0000000003200000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1704 set thread context of 2000	1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2000	1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe	29
PID 1704 wrote to memory of 2000	1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe	29
PID 1704 wrote to memory of 2000	1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe	29
PID 1704 wrote to memory of 2000	1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe	29
PID 1704 wrote to memory of 2000	1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe	29
PID 1704 wrote to memory of 2000	1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe	29
PID 1704 wrote to memory of 2000	1704	3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe	29

C:\Users\Admin\AppData\Local\Temp\3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe
"C:\Users\Admin\AppData\Local\Temp\3a9397af4dfc720df6b8d7c2949bcac307fd5c2540ca114904f43c162e0f4a4b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe
  2⤵
  PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1704-55-0x0000000002580000-0x0000000002B10000-memory.dmp

Filesize
5.6MB

Download
memory/1704-56-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1704-59-0x0000000010000000-0x0000000010089000-memory.dmp

Filesize
548KB

Download
memory/1704-63-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1704-64-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing