darkvnc | 5bf3863bd0b4af59a4cdf9b9080b60c827cc19e368beae60ea3930adf12ddec0

Analysis

max time kernel
151s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
Size

12.1MB
MD5

0ef4e3af8936e03be74afa2395286301
SHA1

273dd0dde838b7878b2870c8a4e2f1fb0d91e6fd
SHA256

5bf3863bd0b4af59a4cdf9b9080b60c827cc19e368beae60ea3930adf12ddec0
SHA512

6938a111a124bc82d8d0576dc7769170974575ba2c545c53424a7285e6da242dc39f722920adfba88c472ba88313b6e0d682183a6fdb15df1ba98f5cf723c79a
SSDEEP

393216:nzbN0o5te8ZBAVVrXcC73WQGb7wWHeigBlRaJFLQM:nzhFlBAVVrXcCybM3gLQ

Score

10^/10

darkvnc rat

Malware Config

Signatures

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4168-1474-0x0000000000400000-0x0000000000488000-memory.dmp	darkvnc
behavioral2/memory/4108-1476-0x0000000000170000-0x0000000000239000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5016 set thread context of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 4168 set thread context of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	90

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 5016 wrote to memory of 4168	5016	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	89
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	90
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	90
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	90
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	90
PID 4168 wrote to memory of 4108	4168	SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe	90

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DropperX-gen.28420.31272.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k
    3⤵
    PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4108-1476-0x0000000000170000-0x0000000000239000-memory.dmp

Filesize
804KB

Download
memory/4108-1475-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/4168-1474-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/5016-170-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-135-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-140-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-142-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-144-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-146-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-148-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-150-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-172-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-154-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-156-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-158-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-160-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-162-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-164-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-166-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-168-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-133-0x00000000001C0000-0x0000000000DDC000-memory.dmp

Filesize
12.1MB

Download
memory/5016-152-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-138-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-186-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-178-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-180-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-182-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-184-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-174-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-188-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-192-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-190-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-194-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-196-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-198-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-1080-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/5016-1458-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/5016-1459-0x00000000074C0000-0x0000000007A64000-memory.dmp

Filesize
5.6MB

Download
memory/5016-136-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-176-0x0000000006850000-0x000000000694E000-memory.dmp

Filesize
1016KB

Download
memory/5016-134-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download