darkvnc | 383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1

Analysis

max time kernel
98s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
Size

12.2MB
MD5

450d8900f699a7730d0219ab789fc7b2
SHA1

713a63d0321c51b0c91347d407ece92d8800c0aa
SHA256

383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1
SHA512

82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418
SSDEEP

196608:7zLA8rc2nh3bgz/KjFmRJKxwYfzBaHIGWtqfuNLPRt7WNGV/5BJOy9k0YNiE3lgq:3Lz5UTKuJKxk9WtUMXVVjYym0Yke

Score

10^/10

darkvnc rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1572-1075-0x0000000000400000-0x0000000000488000-memory.dmp	darkvnc
behavioral2/memory/2692-1077-0x0000000000C30000-0x0000000000CF9000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 2 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.24734.17790.exeSecuriteInfo.com.Win32.RATX-gen.24734.17790.exe

description	pid	process	target process
PID 4664 set thread context of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 1572 set thread context of 2692	1572	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe

pid process

1572 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe

description pid process

Token: SeDebugPrivilege 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe

pid	process
1572	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe

description	pid	process
Token: SeDebugPrivilege	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.24734.17790.exeSecuriteInfo.com.Win32.RATX-gen.24734.17790.exe

description	pid	process	target process
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 4664 wrote to memory of 1572	4664	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
PID 1572 wrote to memory of 2692	1572	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	svchost.exe
PID 1572 wrote to memory of 2692	1572	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	svchost.exe
PID 1572 wrote to memory of 2692	1572	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	svchost.exe
PID 1572 wrote to memory of 2692	1572	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	svchost.exe
PID 1572 wrote to memory of 2692	1572	SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k
    3⤵
    PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-1075-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2692-1077-0x0000000000C30000-0x0000000000CF9000-memory.dmp

Filesize
804KB

Download
memory/2692-1076-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/4664-167-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-199-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-138-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-139-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-141-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-143-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-145-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-147-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-149-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-151-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-153-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-155-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-157-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-173-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-161-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-163-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-165-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-133-0x0000000000E70000-0x0000000001AB4000-memory.dmp

Filesize
12.3MB

Download
memory/4664-135-0x0000000006490000-0x00000000064A0000-memory.dmp

Filesize
64KB

Download
memory/4664-137-0x00000000076F0000-0x0000000007782000-memory.dmp

Filesize
584KB

Download
memory/4664-159-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-175-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-177-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-179-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-181-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-183-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-185-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-187-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-189-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-191-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-195-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-193-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-197-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-171-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-201-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-1060-0x0000000006C00000-0x0000000006C01000-memory.dmp

Filesize
4KB

Download
memory/4664-136-0x0000000007BF0000-0x0000000008194000-memory.dmp

Filesize
5.6MB

Download
memory/4664-169-0x0000000007560000-0x0000000007638000-memory.dmp

Filesize
864KB

Download
memory/4664-134-0x0000000006490000-0x00000000064A0000-memory.dmp

Filesize
64KB

Download