darkvnc | f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8

Analysis

max time kernel
138s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 13:40

Target

f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8.dll
Size

534KB
MD5

0d6e174966870dedb0843ab37b491c21
SHA1

94d0ea8fcb539e9e26053d4e3b8c24f31cfdf7e8
SHA256

f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8
SHA512

90e53382001181b336210fb6527a7b4c84e24db1a0ff3a718b36cc7e533f1e1270b3eaf7df47251bde3f888a839b26d41c1c6caad8eaf7260d4b685492632993
SSDEEP

12288:h201Bz+u8hEWcitltfuzUoBP78fCSxGGS1c9wIl1JS0:h201Mbtcw2gYP7exFSLInL

Score

10^/10

darkvnc rat

DarkVNC
DarkVNC is a malicious version of the famous VNC software.
rat darkvnc

DarkVNC payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1904-2-0x0000000000F20000-0x0000000000FE9000-memory.dmp	darkvnc
behavioral2/memory/1904-3-0x0000000000F20000-0x0000000000FE9000-memory.dmp	darkvnc
behavioral2/memory/1904-7-0x0000000000F20000-0x0000000000FE9000-memory.dmp	darkvnc
behavioral2/memory/1904-8-0x0000000000F20000-0x0000000000FE9000-memory.dmp	darkvnc
behavioral2/memory/1904-9-0x0000000000F20000-0x0000000000FE9000-memory.dmp	darkvnc
behavioral2/memory/1904-10-0x0000000000F20000-0x0000000000FE9000-memory.dmp	darkvnc
behavioral2/memory/1904-11-0x0000000000F20000-0x0000000000FE9000-memory.dmp	darkvnc

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1048 set thread context of 1904 1048 rundll32.exe notepad.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1048 rundll32.exe

description	pid	process	target process
PID 1048 set thread context of 1904	1048	rundll32.exe	notepad.exe

pid	process
1048	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4988 wrote to memory of 1048	4988	rundll32.exe	rundll32.exe
PID 4988 wrote to memory of 1048	4988	rundll32.exe	rundll32.exe
PID 4988 wrote to memory of 1048	4988	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 1904	1048	rundll32.exe	notepad.exe
PID 1048 wrote to memory of 1904	1048	rundll32.exe	notepad.exe
PID 1048 wrote to memory of 1904	1048	rundll32.exe	notepad.exe
PID 1048 wrote to memory of 1904	1048	rundll32.exe	notepad.exe
PID 1048 wrote to memory of 1904	1048	rundll32.exe	notepad.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3ccf5ab10c55af91804220c822086180e9b950709f92cfa4c2c33667a4b54f8.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\notepad.exe
    C:\Windows\system32\notepad.exe -k
    3⤵
    PID:1904

memory/1904-2-0x0000000000F20000-0x0000000000FE9000-memory.dmp

Filesize
804KB

Download
memory/1904-3-0x0000000000F20000-0x0000000000FE9000-memory.dmp

Filesize
804KB

Download
memory/1904-1-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/1904-7-0x0000000000F20000-0x0000000000FE9000-memory.dmp

Filesize
804KB

Download
memory/1904-8-0x0000000000F20000-0x0000000000FE9000-memory.dmp

Filesize
804KB

Download
memory/1904-9-0x0000000000F20000-0x0000000000FE9000-memory.dmp

Filesize
804KB

Download
memory/1904-10-0x0000000000F20000-0x0000000000FE9000-memory.dmp

Filesize
804KB

Download
memory/1904-11-0x0000000000F20000-0x0000000000FE9000-memory.dmp

Filesize
804KB

Download