darkvnc | f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 13:40

Target

f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8.dll
Size

534KB
MD5

0d6e174966870dedb0843ab37b491c21
SHA1

94d0ea8fcb539e9e26053d4e3b8c24f31cfdf7e8
SHA256

f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8
SHA512

90e53382001181b336210fb6527a7b4c84e24db1a0ff3a718b36cc7e533f1e1270b3eaf7df47251bde3f888a839b26d41c1c6caad8eaf7260d4b685492632993
SSDEEP

12288:h201Bz+u8hEWcitltfuzUoBP78fCSxGGS1c9wIl1JS0:h201Mbtcw2gYP7exFSLInL

Score

10^/10

darkvnc rat

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2804-5-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-9-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-10-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-11-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-12-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc
behavioral1/memory/2804-13-0x0000000001B80000-0x0000000001C49000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2948 set thread context of 2804 2948 rundll32.exe notepad.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2948 rundll32.exe

description	pid	process	target process
PID 2948 set thread context of 2804	2948	rundll32.exe	notepad.exe

pid	process
2948	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2168 wrote to memory of 2948	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2948	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2948	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2948	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2948	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2948	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2948	2168	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2804	2948	rundll32.exe	notepad.exe
PID 2948 wrote to memory of 2804	2948	rundll32.exe	notepad.exe
PID 2948 wrote to memory of 2804	2948	rundll32.exe	notepad.exe
PID 2948 wrote to memory of 2804	2948	rundll32.exe	notepad.exe
PID 2948 wrote to memory of 2804	2948	rundll32.exe	notepad.exe
PID 2948 wrote to memory of 2804	2948	rundll32.exe	notepad.exe
PID 2948 wrote to memory of 2804	2948	rundll32.exe	notepad.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

memory/2804-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2804-2-0x000007FFFFFD7000-0x000007FFFFFD8000-memory.dmp

Filesize
4KB

Download
memory/2804-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2804-5-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-9-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-10-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-11-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-12-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download
memory/2804-13-0x0000000001B80000-0x0000000001C49000-memory.dmp

Filesize
804KB

Download