darkvnc | a1c7a2331009bf0cac46f57a5446d3c969161c435c67ac4a1b98c0a4ce712787

Analysis

max time kernel
101s
max time network
102s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
Size

12.3MB
MD5

78ca6266294789d169792c330758cb4c
SHA1

01474dea306722d9da1ae2a83aa089912b989861
SHA256

a1c7a2331009bf0cac46f57a5446d3c969161c435c67ac4a1b98c0a4ce712787
SHA512

c5c36b2177d3bfdb3ff9a3730587af7bbc76b3c53b0934a6737cd3e6e248e3d4da91d9436f7e9bdc8b244444f511f0ffb9560d7446d2132903477751724c24f5
SSDEEP

196608:HGzErOAvYMg2gO1wjcjOJCx9zFajuc0diN+O3L0B4NoRgLRhwzCpJXd3mIqN2sqx:mzyqN4wLJCBLliNZ70ERmgJN3mH

Score

10^/10

darkvnc persistence rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1084-1001-0x0000000000400000-0x0000000000488000-memory.dmp	darkvnc
behavioral1/memory/1740-1010-0x00000000003A0000-0x0000000000469000-memory.dmp	darkvnc
behavioral1/memory/1084-1011-0x0000000000400000-0x0000000000488000-memory.dmp	darkvnc

Executes dropped EXE 2 IoCs

Processes:

whileemploy_1.exewhileemploy_1.exe

pid	Process
2040	whileemploy_1.exe
1084	whileemploy_1.exe

Loads dropped DLL 1 IoCs

Processes:

whileemploy_1.exe

pid	Process
2040	whileemploy_1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

whileemploy_1.exewhileemploy_1.exe

description	pid	Process	procid_target
PID 2040 set thread context of 1084	2040	whileemploy_1.exe	28
PID 1084 set thread context of 1740	1084	whileemploy_1.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

whileemploy_1.exe

pid	Process
1084	whileemploy_1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

whileemploy_1.exe

description	pid	Process
Token: SeDebugPrivilege	2040	whileemploy_1.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exewhileemploy_1.exewhileemploy_1.exe

description	pid	Process	procid_target
PID 2044 wrote to memory of 2040	2044	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe	27
PID 2044 wrote to memory of 2040	2044	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe	27
PID 2044 wrote to memory of 2040	2044	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe	27
PID 2044 wrote to memory of 2040	2044	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe	27
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 2040 wrote to memory of 1084	2040	whileemploy_1.exe	28
PID 1084 wrote to memory of 1740	1084	whileemploy_1.exe	29
PID 1084 wrote to memory of 1740	1084	whileemploy_1.exe	29
PID 1084 wrote to memory of 1740	1084	whileemploy_1.exe	29
PID 1084 wrote to memory of 1740	1084	whileemploy_1.exe	29
PID 1084 wrote to memory of 1740	1084	whileemploy_1.exe	29
PID 1084 wrote to memory of 1740	1084	whileemploy_1.exe	29
PID 1084 wrote to memory of 1740	1084	whileemploy_1.exe	29

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k
      4⤵
      PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe

Filesize
12.2MB

MD5
450d8900f699a7730d0219ab789fc7b2

SHA1
713a63d0321c51b0c91347d407ece92d8800c0aa

SHA256
383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1

SHA512
82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe

Filesize
12.2MB

MD5
450d8900f699a7730d0219ab789fc7b2

SHA1
713a63d0321c51b0c91347d407ece92d8800c0aa

SHA256
383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1

SHA512
82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe

Filesize
12.2MB

MD5
450d8900f699a7730d0219ab789fc7b2

SHA1
713a63d0321c51b0c91347d407ece92d8800c0aa

SHA256
383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1

SHA512
82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe

Filesize
12.2MB

MD5
450d8900f699a7730d0219ab789fc7b2

SHA1
713a63d0321c51b0c91347d407ece92d8800c0aa

SHA256
383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1

SHA512
82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418

Download Submit
memory/1084-1011-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1084-1001-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1740-1010-0x00000000003A0000-0x0000000000469000-memory.dmp

Filesize
804KB

Download
memory/1740-1009-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2040-99-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-105-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-71-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-73-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-75-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-77-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-79-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-81-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-83-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-85-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-87-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-89-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-91-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-93-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-95-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-97-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-67-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-101-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-103-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-69-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-107-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-109-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-111-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-113-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-115-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-117-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-119-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-121-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-123-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-125-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-127-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-986-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/2040-987-0x00000000059A0000-0x0000000005A08000-memory.dmp

Filesize
416KB

Download
memory/2040-988-0x0000000004E80000-0x0000000004ECC000-memory.dmp

Filesize
304KB

Download
memory/2040-65-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-64-0x0000000006470000-0x0000000006548000-memory.dmp

Filesize
864KB

Download
memory/2040-63-0x0000000006470000-0x000000000654E000-memory.dmp

Filesize
888KB

Download
memory/2040-62-0x0000000005860000-0x00000000058A0000-memory.dmp

Filesize
256KB

Download
memory/2040-61-0x0000000005860000-0x00000000058A0000-memory.dmp

Filesize
256KB

Download
memory/2040-60-0x0000000000870000-0x00000000014B4000-memory.dmp

Filesize
12.3MB

Download