darkvnc | 5bf3863bd0b4af59a4cdf9b9080b60c827cc19e368beae60ea3930adf12ddec0

General

Target

SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
Size

12.1MB
MD5

0ef4e3af8936e03be74afa2395286301
SHA1

273dd0dde838b7878b2870c8a4e2f1fb0d91e6fd
SHA256

5bf3863bd0b4af59a4cdf9b9080b60c827cc19e368beae60ea3930adf12ddec0
SHA512

6938a111a124bc82d8d0576dc7769170974575ba2c545c53424a7285e6da242dc39f722920adfba88c472ba88313b6e0d682183a6fdb15df1ba98f5cf723c79a
SSDEEP

393216:nzbN0o5te8ZBAVVrXcC73WQGb7wWHeigBlRaJFLQM:nzhFlBAVVrXcCybM3gLQ

Score

10^/10

darkvnc rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4168-1474-0x0000000000400000-0x0000000000488000-memory.dmp	darkvnc
behavioral2/memory/4108-1476-0x0000000000170000-0x0000000000239000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 2 IoCs

Processes:

SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exeSecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

description	pid	process	target process
PID 5016 set thread context of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 4168 set thread context of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

pid process

5016 SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

pid process

4168 SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

description pid process

Token: SeDebugPrivilege 5016 SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

pid	process
5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

pid	process
4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

description	pid	process
Token: SeDebugPrivilege	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exeSecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

description	pid	process	target process
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	svchost.exe
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	svchost.exe
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	svchost.exe
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	svchost.exe
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k
3⤵
PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4108-1476-0x0000000000170000-0x0000000000239000-memory.dmp

Filesize
804KB

Download
memory/4108-1475-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/4168-1474-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/5016-170-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-135-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-140-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-142-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-144-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-146-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-148-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-150-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-172-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-154-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-156-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-158-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-160-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-162-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-164-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-166-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-168-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-133-0x00000000001C0000-0x0000000000DDC000-memory.dmp

Filesize
12.1MB

Download
memory/5016-152-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-138-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-186-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-178-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-180-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-182-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-184-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-174-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-188-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-192-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-190-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-194-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-196-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-198-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-1080-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/5016-1458-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/5016-1459-0x00000000074C0000-0x0000000007A64000-memory.dmp

Filesize
5.6MB

Download
memory/5016-136-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-176-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-134-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads