darkvnc | 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff

General

Target

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
Size

901KB
MD5

a6e9ff0cd09cbe50096fdf30aed057aa
SHA1

678f76dab9b7e0f0ef1a0917b2fad5e10b16a23a
SHA256

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff
SHA512

3ac902f1a0d0e13ad379dd8ed318fb29becd77068b6dc268ec699696bd843f8fbe34e41fd0b770e373d1f0478c8850f49bf3f9f56efa84e0fc9df1fc0294a78f
SSDEEP

24576:wh7qXY/21x+kdEvWft7Wsfogur37HuXIqQ:wtp21QkdE+Zbf4+XIqQ

Score

10^/10

darkvnc rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/668-76-0x0000000010000000-0x0000000010089000-memory.dmp	darkvnc
behavioral1/memory/668-81-0x0000000002700000-0x0000000002840000-memory.dmp	darkvnc
behavioral1/memory/1016-83-0x0000000001B40000-0x0000000001C09000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 668 set thread context of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1168	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28
PID 1736 wrote to memory of 1168	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28
PID 1736 wrote to memory of 1168	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28
PID 1736 wrote to memory of 1168	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	29
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	30
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	30
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	30
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	30
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	30
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	30
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	30

C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
"C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
  "{path}"
  2⤵
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe
    3⤵
    PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-68-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-76-0x0000000010000000-0x0000000010089000-memory.dmp

Filesize
548KB

Download
memory/668-82-0x0000000000401000-0x000000000044A000-memory.dmp

Filesize
292KB

Download
memory/668-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-58-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-71-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-81-0x0000000002700000-0x0000000002840000-memory.dmp

Filesize
1.2MB

Download
memory/668-80-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/668-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-73-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-74-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-75-0x0000000000401000-0x000000000044A000-memory.dmp

Filesize
292KB

Download
memory/1016-83-0x0000000001B40000-0x0000000001C09000-memory.dmp

Filesize
804KB

Download
memory/1736-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/1736-57-0x0000000005080000-0x0000000005146000-memory.dmp

Filesize
792KB

Download
memory/1736-54-0x0000000000970000-0x0000000000A4C000-memory.dmp

Filesize
880KB

Download

Analysis

Sharing