darkvnc | 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff

General

Target

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
Size

901KB
MD5

a6e9ff0cd09cbe50096fdf30aed057aa
SHA1

678f76dab9b7e0f0ef1a0917b2fad5e10b16a23a
SHA256

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff
SHA512

3ac902f1a0d0e13ad379dd8ed318fb29becd77068b6dc268ec699696bd843f8fbe34e41fd0b770e373d1f0478c8850f49bf3f9f56efa84e0fc9df1fc0294a78f
SSDEEP

24576:wh7qXY/21x+kdEvWft7Wsfogur37HuXIqQ:wtp21QkdE+Zbf4+XIqQ

Score

10^/10

darkvnc rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/668-76-0x0000000010000000-0x0000000010089000-memory.dmp	darkvnc
behavioral1/memory/668-81-0x0000000002700000-0x0000000002840000-memory.dmp	darkvnc
behavioral1/memory/1016-83-0x0000000001B40000-0x0000000001C09000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 2 IoCs

Processes:

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

description	pid	process	target process
PID 1736 set thread context of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 668 set thread context of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

pid process

1736 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

pid process

668 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

pid process

668 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

description pid process

Token: SeDebugPrivilege 1736 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

pid	process
1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

pid	process
668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

pid	process
668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

description	pid	process
Token: SeDebugPrivilege	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe

C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
"C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
"{path}"
2⤵
PID:1168

C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe
3⤵
PID:1016

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-68-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-76-0x0000000010000000-0x0000000010089000-memory.dmp

Filesize
548KB

Download
memory/668-69-0x0000000000401000-mapping.dmp

Download
memory/668-82-0x0000000000401000-0x000000000044A000-memory.dmp

Filesize
292KB

Download
memory/668-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-58-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-71-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-81-0x0000000002700000-0x0000000002840000-memory.dmp

Filesize
1.2MB

Download
memory/668-80-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/668-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-73-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-74-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/668-75-0x0000000000401000-0x000000000044A000-memory.dmp

Filesize
292KB

Download
memory/1016-79-0x0000000000000000-mapping.dmp

Download
memory/1016-83-0x0000000001B40000-0x0000000001C09000-memory.dmp

Filesize
804KB

Download
memory/1736-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/1736-57-0x0000000005080000-0x0000000005146000-memory.dmp

Filesize
792KB

Download
memory/1736-54-0x0000000000970000-0x0000000000A4C000-memory.dmp

Filesize
880KB

Download

description	pid	process	target process
PID 1736 wrote to memory of 1168	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 1168	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 1168	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 1168	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 1736 wrote to memory of 668	1736	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	WerFault.exe
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	WerFault.exe
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	WerFault.exe
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	WerFault.exe
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	WerFault.exe
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	WerFault.exe
PID 668 wrote to memory of 1016	668	28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads