darkvision | d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6

Resubmissions

25-11-2024 20:05

241125-yts4hatnbw 10

19-11-2024 09:15

241119-k7462aykbj 10

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe
Size

1.1MB
MD5

4c99b8a6627bee05a1de8d9061631551
SHA1

4cb8a13eb146431ee6d45d4b8daab7088e9ae5c2
SHA256

d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6
SHA512

a17a604f3eda7d04dff453ebe3548b25e43c1fe9f0cd9702a75c20cd87ad16adafb1d3edae8f8c886a1b81173a4fbbdec7d5fd009feb3869701e9cb170756b42
SSDEEP

24576:BftC16YGW3ad7jWpZAgcteeJp5uXirVpVwL03E+g1RRN9wVQ:BfYhwd7jkAgc1BrVrPEtRd

Score

10^/10

darkvision rat

Malware Config

Extracted

Family

darkvision

http://fiestagrandefm.com/ss/upload.php

85.209.133.9

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31
PID 2480 wrote to memory of 2496	2480	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	31

C:\Users\Admin\AppData\Local\Temp\d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe
"C:\Users\Admin\AppData\Local\Temp\d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/2480-1-0x000000013FAD0000-0x000000013FBEA000-memory.dmp

Filesize
1.1MB

Download
memory/2480-2-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download
memory/2480-3-0x00000000001C0000-0x00000000001E6000-memory.dmp

Filesize
152KB

Download
memory/2480-4-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/2480-5-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download
memory/2480-6-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download
memory/2480-7-0x000000001C2C0000-0x000000001C378000-memory.dmp

Filesize
736KB

Download
memory/2480-17-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download
memory/2496-13-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-14-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-12-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-16-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-15-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

Filesize
4KB

Download
memory/2496-11-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-9-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-10-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-20-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-19-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-8-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/2496-21-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download