darkvision | dd86228f22a372a870efd571580bd2800c79f502a70a9b47aab2bdb10ca5766b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd86228f22a372a870efd571580bd2800c79f502a70a9b47aab2bdb10ca5766b.exe
Size

4.0MB
MD5

247e35b36f1fa7310918e3bf28ce0298
SHA1

3069f557958742358302fcc216f3c80517733c22
SHA256

dd86228f22a372a870efd571580bd2800c79f502a70a9b47aab2bdb10ca5766b
SHA512

d702adb486eeaf270ee0904a5d6ef277025414bf050d392766763b49fa5b675939435913be7e57592757eb6d2c9f5ec93352b0714a1869fc2d71c3cb42f8495f
SSDEEP

49152:GHC3lll91kgrtu/Q+CSj2BUKWXBt1eHx/G039ygNHhPguc:NB1NgnNj2BqX7B03sgNHhl

Score

10^/10

darkvision rat

Malware Config

Extracted

Family

darkvision

powercycle.ddns.net

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dd86228f22a372a870efd571580bd2800c79f502a70a9b47aab2bdb10ca5766b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dd86228f22a372a870efd571580bd2800c79f502a70a9b47aab2bdb10ca5766b.exe

C:\Users\Admin\AppData\Local\Temp\dd86228f22a372a870efd571580bd2800c79f502a70a9b47aab2bdb10ca5766b.exe
"C:\Users\Admin\AppData\Local\Temp\dd86228f22a372a870efd571580bd2800c79f502a70a9b47aab2bdb10ca5766b.exe"
1⤵
- Checks BIOS information in registry
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-1-0x0000000076F30000-0x0000000076F32000-memory.dmp

Filesize
8KB

Download
memory/2284-0-0x000000013F290000-0x000000013F69C000-memory.dmp

Filesize
4.0MB

Download
memory/2284-3-0x000000013F290000-0x000000013F69C000-memory.dmp

Filesize
4.0MB

Download