darkvnc | 67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe
Size

542KB
MD5

ba8a5f2f4ed11ccd9225f2511adab2ae
SHA1

523762dcdc6bcdf606d53236d74ec5a273fcbf12
SHA256

67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9
SHA512

ecb74bd7e52d318c7b0c2568d56dfd2564b3b0cd29125cd4fb71198c0a2c8fbf761d4c2e85ef5f14d9e1b716499308209a15ebd9169ca625d6306569bef5d500
SSDEEP

12288:zWR651v0Rkf6vu9jT98AvNKBZllnEmYDZV7SZ+:z6asRkSEjTOYNKrfEmYDTSQ

Score

10^/10

darkvnc rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1364-57-0x0000000010000000-0x0000000010089000-memory.dmp	darkvnc
behavioral1/memory/1328-66-0x0000000001B30000-0x0000000001BF9000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

Processes:

67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

description	pid	process	target process
PID 1364 set thread context of 1328	1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

pid process

1364 67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

pid process

1364 67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

pid process

1364 67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

pid	process
1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

pid	process
1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

pid	process
1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe

description	pid	process	target process
PID 1364 wrote to memory of 1328	1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe	WerFault.exe
PID 1364 wrote to memory of 1328	1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe	WerFault.exe
PID 1364 wrote to memory of 1328	1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe	WerFault.exe
PID 1364 wrote to memory of 1328	1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe	WerFault.exe
PID 1364 wrote to memory of 1328	1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe	WerFault.exe
PID 1364 wrote to memory of 1328	1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe	WerFault.exe
PID 1364 wrote to memory of 1328	1364	67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe
"C:\Users\Admin\AppData\Local\Temp\67228849b80880ab0bd4d4b6c59c15ce97e13d790aed826b7558a888492652c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe
  2⤵
  PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-60-0x0000000000000000-mapping.dmp

Download
memory/1328-66-0x0000000001B30000-0x0000000001BF9000-memory.dmp

Filesize
804KB

Download
memory/1364-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1364-56-0x0000000000400000-0x0000000000881000-memory.dmp

Filesize
4.5MB

Download
memory/1364-57-0x0000000010000000-0x0000000010089000-memory.dmp

Filesize
548KB

Download
memory/1364-61-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/1364-62-0x0000000000890000-0x0000000000908000-memory.dmp

Filesize
480KB

Download
memory/1364-63-0x0000000000400000-0x0000000000881000-memory.dmp

Filesize
4.5MB

Download
memory/1364-64-0x0000000000400000-0x0000000000881000-memory.dmp

Filesize
4.5MB

Download
memory/1364-65-0x0000000000400000-0x0000000000881000-memory.dmp

Filesize
4.5MB

Download
memory/1364-67-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download