darkvnc | a1c7a2331009bf0cac46f57a5446d3c969161c435c67ac4a1b98c0a4ce712787

Analysis

max time kernel
85s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
Size

12.3MB
MD5

78ca6266294789d169792c330758cb4c
SHA1

01474dea306722d9da1ae2a83aa089912b989861
SHA256

a1c7a2331009bf0cac46f57a5446d3c969161c435c67ac4a1b98c0a4ce712787
SHA512

c5c36b2177d3bfdb3ff9a3730587af7bbc76b3c53b0934a6737cd3e6e248e3d4da91d9436f7e9bdc8b244444f511f0ffb9560d7446d2132903477751724c24f5
SSDEEP

196608:HGzErOAvYMg2gO1wjcjOJCx9zFajuc0diN+O3L0B4NoRgLRhwzCpJXd3mIqN2sqx:mzyqN4wLJCBLliNZ70ERmgJN3mH

Score

10^/10

darkvnc persistence rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3892-1071-0x0000000000400000-0x0000000000488000-memory.dmp	darkvnc
behavioral2/memory/3892-1081-0x0000000000400000-0x0000000000488000-memory.dmp	darkvnc
behavioral2/memory/3200-1083-0x0000000000300000-0x00000000003C9000-memory.dmp	darkvnc

Executes dropped EXE 2 IoCs

Processes:

whileemploy_1.exewhileemploy_1.exe

pid process

4108 whileemploy_1.exe
3892 whileemploy_1.exe

pid	process
4108	whileemploy_1.exe
3892	whileemploy_1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

whileemploy_1.exewhileemploy_1.exe

description	pid	process	target process
PID 4108 set thread context of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 3892 set thread context of 3200	3892	whileemploy_1.exe	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

whileemploy_1.exe

pid process

3892 whileemploy_1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

whileemploy_1.exe

description pid process

Token: SeDebugPrivilege 4108 whileemploy_1.exe

pid	process
3892	whileemploy_1.exe

description	pid	process
Token: SeDebugPrivilege	4108	whileemploy_1.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exewhileemploy_1.exewhileemploy_1.exe

description	pid	process	target process
PID 1900 wrote to memory of 4108	1900	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe	whileemploy_1.exe
PID 1900 wrote to memory of 4108	1900	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe	whileemploy_1.exe
PID 1900 wrote to memory of 4108	1900	SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 4108 wrote to memory of 3892	4108	whileemploy_1.exe	whileemploy_1.exe
PID 3892 wrote to memory of 3200	3892	whileemploy_1.exe	svchost.exe
PID 3892 wrote to memory of 3200	3892	whileemploy_1.exe	svchost.exe
PID 3892 wrote to memory of 3200	3892	whileemploy_1.exe	svchost.exe
PID 3892 wrote to memory of 3200	3892	whileemploy_1.exe	svchost.exe
PID 3892 wrote to memory of 3200	3892	whileemploy_1.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Generic.33993308.27608.29847.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k
      4⤵
      PID:3200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe

Filesize
12.2MB

MD5
450d8900f699a7730d0219ab789fc7b2

SHA1
713a63d0321c51b0c91347d407ece92d8800c0aa

SHA256
383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1

SHA512
82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe

Filesize
12.2MB

MD5
450d8900f699a7730d0219ab789fc7b2

SHA1
713a63d0321c51b0c91347d407ece92d8800c0aa

SHA256
383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1

SHA512
82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whileemploy_1.exe

Filesize
12.2MB

MD5
450d8900f699a7730d0219ab789fc7b2

SHA1
713a63d0321c51b0c91347d407ece92d8800c0aa

SHA256
383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1

SHA512
82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418

Download Submit
memory/3200-1083-0x0000000000300000-0x00000000003C9000-memory.dmp

Filesize
804KB

Download
memory/3200-1082-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/3892-1081-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3892-1071-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4108-173-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-181-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-147-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-149-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-151-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-153-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-155-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-157-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-159-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-161-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-163-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-165-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-167-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-169-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-171-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-143-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-175-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-177-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-179-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-145-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-183-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-185-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-187-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-189-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-191-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-193-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-195-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-197-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-199-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-201-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-203-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-205-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-1064-0x0000000006A10000-0x0000000006A11000-memory.dmp

Filesize
4KB

Download
memory/4108-142-0x0000000006870000-0x0000000006948000-memory.dmp

Filesize
864KB

Download
memory/4108-141-0x0000000006A70000-0x0000000006B02000-memory.dmp

Filesize
584KB

Download
memory/4108-140-0x00000000078E0000-0x0000000007E84000-memory.dmp

Filesize
5.6MB

Download
memory/4108-139-0x0000000006210000-0x0000000006220000-memory.dmp

Filesize
64KB

Download
memory/4108-138-0x0000000000AC0000-0x0000000001704000-memory.dmp

Filesize
12.3MB

Download