darkvision | d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe
Size

1.1MB
MD5

4c99b8a6627bee05a1de8d9061631551
SHA1

4cb8a13eb146431ee6d45d4b8daab7088e9ae5c2
SHA256

d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6
SHA512

a17a604f3eda7d04dff453ebe3548b25e43c1fe9f0cd9702a75c20cd87ad16adafb1d3edae8f8c886a1b81173a4fbbdec7d5fd009feb3869701e9cb170756b42
SSDEEP

24576:BftC16YGW3ad7jWpZAgcteeJp5uXirVpVwL03E+g1RRN9wVQ:BfYhwd7jkAgc1BrVrPEtRd

Score

10^/10

darkvision rat

Malware Config

Extracted

Family

darkvision

http://fiestagrandefm.com/ss/upload.php

85.209.133.9

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision
Downloads MZ/PE file
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4076 set thread context of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3436	vbc.exe
3436	vbc.exe
3436	vbc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 4076 wrote to memory of 3436	4076	d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe	89
PID 3436 wrote to memory of 1128	3436	vbc.exe	90
PID 3436 wrote to memory of 1128	3436	vbc.exe	90

C:\Users\Admin\AppData\Local\Temp\d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe
"C:\Users\Admin\AppData\Local\Temp\d5001f35264c4470284bfad49145318d9c68700fe34b7bad8fbdc391500b3eb6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\EXPLORER.EXE
    C:\Windows\EXPLORER.EXE {F34EC6D1-895B-4806-959C-01B8FEAFF719}
    3⤵
    PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DATABASE

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
memory/1128-17-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1128-32-0x0000000002D40000-0x0000000002E43000-memory.dmp

Filesize
1.0MB

Download
memory/1128-24-0x0000000002D40000-0x0000000002E43000-memory.dmp

Filesize
1.0MB

Download
memory/1128-18-0x0000000002D40000-0x0000000002E43000-memory.dmp

Filesize
1.0MB

Download
memory/3436-14-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/3436-12-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/3436-33-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/3436-8-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/3436-10-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/3436-16-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/3436-13-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/4076-6-0x000001D4B3010000-0x000001D4B3024000-memory.dmp

Filesize
80KB

Download
memory/4076-15-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-0-0x00007FFA88833000-0x00007FFA88835000-memory.dmp

Filesize
8KB

Download
memory/4076-5-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-4-0x00007FFA88833000-0x00007FFA88835000-memory.dmp

Filesize
8KB

Download
memory/4076-3-0x000001D4B2F90000-0x000001D4B2FB6000-memory.dmp

Filesize
152KB

Download
memory/4076-2-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-1-0x000001D498A80000-0x000001D498B9A000-memory.dmp

Filesize
1.1MB

Download
memory/4076-7-0x000001D4B4300000-0x000001D4B43B8000-memory.dmp

Filesize
736KB

Download