darkvision | 74e66581cda6b55f9dbfcfe260faec1dad8a38d9fa0c5c2f45e64d16e6a11d4e

General

Target

fortnite.exe
Size

1.4MB
MD5

5999098b0f0e4e25e826092a7f1e7598
SHA1

76f8454429e4a59e4b7361415a6d62e08207577e
SHA256

74e66581cda6b55f9dbfcfe260faec1dad8a38d9fa0c5c2f45e64d16e6a11d4e
SHA512

7d43edd26d68f5f51478a6e8f75652bf15a9704c89f4d70c6115c51989c9e60a726124c4ddabd5a95917a537b066a0d6ecef3b737492706e82e5493a63ce36c1
SSDEEP

24576:PW0EbEOAkR+9yJgoHqWnKwVIL4I9fGzPvW4C30Wemex2ze+9S:PW0kTdnn9RP

Score

10^/10

darkvision defense_evasion execution rat

Malware Config

Extracted

Family

darkvision

C2

154.216.17.115

https://rentry.co/razorrat/rawYDHXBF8ZTF

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2820	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1328	OperationEnigma4.exe

Loads dropped DLL 1 IoCs

pid	Process
2264	fortnite.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2760	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2820	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2744	2264	fortnite.exe	31
PID 2264 wrote to memory of 2744	2264	fortnite.exe	31
PID 2264 wrote to memory of 2744	2264	fortnite.exe	31
PID 2264 wrote to memory of 2760	2264	fortnite.exe	32
PID 2264 wrote to memory of 2760	2264	fortnite.exe	32
PID 2264 wrote to memory of 2760	2264	fortnite.exe	32
PID 2760 wrote to memory of 2764	2760	cmd.exe	33
PID 2760 wrote to memory of 2764	2760	cmd.exe	33
PID 2760 wrote to memory of 2764	2760	cmd.exe	33
PID 2264 wrote to memory of 2772	2264	fortnite.exe	34
PID 2264 wrote to memory of 2772	2264	fortnite.exe	34
PID 2264 wrote to memory of 2772	2264	fortnite.exe	34
PID 2772 wrote to memory of 2820	2772	cmd.exe	35
PID 2772 wrote to memory of 2820	2772	cmd.exe	35
PID 2772 wrote to memory of 2820	2772	cmd.exe	35
PID 2264 wrote to memory of 2868	2264	fortnite.exe	36
PID 2264 wrote to memory of 2868	2264	fortnite.exe	36
PID 2264 wrote to memory of 2868	2264	fortnite.exe	36
PID 2868 wrote to memory of 2580	2868	cmd.exe	37
PID 2868 wrote to memory of 2580	2868	cmd.exe	37
PID 2868 wrote to memory of 2580	2868	cmd.exe	37
PID 2264 wrote to memory of 1328	2264	fortnite.exe	38
PID 2264 wrote to memory of 1328	2264	fortnite.exe	38
PID 2264 wrote to memory of 1328	2264	fortnite.exe	38
PID 2264 wrote to memory of 1932	2264	fortnite.exe	39
PID 2264 wrote to memory of 1932	2264	fortnite.exe	39
PID 2264 wrote to memory of 1932	2264	fortnite.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2764	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir "C:\ProgramData\Microsoft\WindowsApps" >nul 2>&1
  2⤵
  PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\ProgramData\Microsoft\WindowsApps" >nul 2>&1
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\ProgramData\Microsoft\WindowsApps"
    3⤵
    - Views/modifies file attributes
    PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionExtension 'exe'" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionExtension 'exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "OperationEnigma" /tr "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe" /sc onlogon /rl highest /f >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "OperationEnigma" /tr "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2580
- C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe
  "C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe"
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 3
  2⤵
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\WindowsApps\OperationEnigma4.exe

Filesize
443KB

MD5
6edcc30095aaa8bad21c5e0a1a92aa9c

SHA1
ac4dc007d65625f55579b16893a0b490e5c6f48a

SHA256
ba3cc8d5120e54c6c8dd15143cddf6b2040e83704caad04373b05ea5fa9a9179

SHA512
06ec237b2ad8002740f104c04213c03c101cc8a4587527135bdb87ca488fac542250209af96cc348d2196a7b3fabe51a035e52c9401000f486e6a6a9c07c46bd

Download Submit
memory/2264-0-0x00000000000F0000-0x000000000016B000-memory.dmp

Filesize
492KB

Download
memory/2264-18-0x00000000000F0000-0x000000000016B000-memory.dmp

Filesize
492KB

Download
memory/2820-5-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2820-6-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2820-7-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2820-8-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2820-13-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2820-11-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2820-10-0x0000000002CEB000-0x0000000002D52000-memory.dmp

Filesize
412KB

Download
memory/2820-9-0x0000000002CE4000-0x0000000002CE7000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads