darkvnc | f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 13:40

Target

f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8.dll
Size

534KB
MD5

0d6e174966870dedb0843ab37b491c21
SHA1

94d0ea8fcb539e9e26053d4e3b8c24f31cfdf7e8
SHA256

f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8
SHA512

90e53382001181b336210fb6527a7b4c84e24db1a0ff3a718b36cc7e533f1e1270b3eaf7df47251bde3f888a839b26d41c1c6caad8eaf7260d4b685492632993
SSDEEP

12288:h201Bz+u8hEWcitltfuzUoBP78fCSxGGS1c9wIl1JS0:h201Mbtcw2gYP7exFSLInL

Score

10^/10

darkvnc rat

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2804-5-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-9-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-10-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-11-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-12-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-13-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2948 set thread context of 2804	2948	rundll32.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid	Process
2948	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 2168 wrote to memory of 2948	2168	rundll32.exe	27
PID 2168 wrote to memory of 2948	2168	rundll32.exe	27
PID 2168 wrote to memory of 2948	2168	rundll32.exe	27
PID 2168 wrote to memory of 2948	2168	rundll32.exe	27
PID 2168 wrote to memory of 2948	2168	rundll32.exe	27
PID 2168 wrote to memory of 2948	2168	rundll32.exe	27
PID 2168 wrote to memory of 2948	2168	rundll32.exe	27
PID 2948 wrote to memory of 2804	2948	rundll32.exe	28
PID 2948 wrote to memory of 2804	2948	rundll32.exe	28
PID 2948 wrote to memory of 2804	2948	rundll32.exe	28
PID 2948 wrote to memory of 2804	2948	rundll32.exe	28
PID 2948 wrote to memory of 2804	2948	rundll32.exe	28
PID 2948 wrote to memory of 2804	2948	rundll32.exe	28
PID 2948 wrote to memory of 2804	2948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\system32\notepad.exe
    C:\Windows\system32\notepad.exe -k
    3⤵
    PID:2804

memory/2804-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2804-2-0x000007FFFFFD7000-0x000007FFFFFD8000-memory.dmp

Filesize
4KB

Download
memory/2804-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2804-5-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-9-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-10-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-11-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-12-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-13-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download