darkvision | 013425ffb967f37556591d596ac033ae3a7ad466c512c32685e0cd960fbe670f

General

Target

2025-04-07_7ad31c28848f1ff2193f807cb3deaaf9_black-basta_cobalt-strike_satacom.exe
Size

780KB
MD5

7ad31c28848f1ff2193f807cb3deaaf9
SHA1

ed58fcebec0ecb5921a3a8f8e1a1647cddfefcfb
SHA256

013425ffb967f37556591d596ac033ae3a7ad466c512c32685e0cd960fbe670f
SHA512

7fd16fd547c86f34f1591bdd2cefc4fb42d6893611e43050519f09e6661a3c02404d308aa4d886e3a2b44859e96700ca1603dd636a631ebcd0dcea3fe733a5a0
SSDEEP

24576:VHHiWcxah9JB/OrWaQ47IbQuLVUpuWsZo:VHHiXahLBWrW58uLVU/sG

Score

10^/10

darkvision execution persistence rat

Malware Config

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3220	powershell.exe
3220	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	defender.exe

Executes dropped EXE 4 IoCs

pid	Process
624	000003d50029.exe
5560	defender.exe
2620	000003d50029.exe
968	defender.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\Documents\\App\\000003d50029.exe"	2025-04-07_7ad31c28848f1ff2193f807cb3deaaf9_black-basta_cobalt-strike_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	powershell.exe
3220	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 3220	5320	2025-04-07_7ad31c28848f1ff2193f807cb3deaaf9_black-basta_cobalt-strike_satacom.exe	87
PID 5320 wrote to memory of 3220	5320	2025-04-07_7ad31c28848f1ff2193f807cb3deaaf9_black-basta_cobalt-strike_satacom.exe	87
PID 5320 wrote to memory of 624	5320	2025-04-07_7ad31c28848f1ff2193f807cb3deaaf9_black-basta_cobalt-strike_satacom.exe	113
PID 5320 wrote to memory of 624	5320	2025-04-07_7ad31c28848f1ff2193f807cb3deaaf9_black-basta_cobalt-strike_satacom.exe	113
PID 624 wrote to memory of 5560	624	000003d50029.exe	114
PID 624 wrote to memory of 5560	624	000003d50029.exe	114
PID 3636 wrote to memory of 2620	3636	cmd.exe	115
PID 3636 wrote to memory of 2620	3636	cmd.exe	115
PID 2620 wrote to memory of 968	2620	000003d50029.exe	116
PID 2620 wrote to memory of 968	2620	000003d50029.exe	116

C:\Users\Admin\AppData\Local\Temp\2025-04-07_7ad31c28848f1ff2193f807cb3deaaf9_black-basta_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-07_7ad31c28848f1ff2193f807cb3deaaf9_black-basta_cobalt-strike_satacom.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\App'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- C:\Users\Admin\Documents\App\000003d50029.exe
  "C:\Users\Admin\Documents\App\000003d50029.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Users\Admin\AppData\Roaming\defender\defender.exe
    "C:\Users\Admin\AppData\Roaming\defender\defender.exe" {D21DBE81-1D94-4C51-8C7C-553B348C2AB9}
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\App\000003d50029.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\Documents\App\000003d50029.exe
  C:\Users\Admin\Documents\App\000003d50029.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Roaming\defender\defender.exe
    "C:\Users\Admin\AppData\Roaming\defender\defender.exe" {D21DBE81-1D94-4C51-8C7C-553B348C2AB9}
    3⤵
    - Executes dropped EXE
    PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_njjda2t4.bik.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Documents\App\000003d50029.exe

Filesize
489KB

MD5
15fd5c7d27c1159f2e0b3d5390cc7ec5

SHA1
2aa47c93a9f39d4972354c7aa7364bd872063bc8

SHA256
ed8c6b20e7465732decc3cf2ea073eea6d4915bcfd3ca5546847489153917f0e

SHA512
86c22f92afa6f4d13bade402f77903b81f2a302103a784aceced83c631cd2e8d67d531a40a512cf0b0eb52e7cddf71a555c80680add1f77f68d3d884637b1802

Download Submit
memory/3220-0-0x00007FFF539F3000-0x00007FFF539F5000-memory.dmp

Filesize
8KB

Download
memory/3220-1-0x000002877F400000-0x000002877F422000-memory.dmp

Filesize
136KB

Download
memory/3220-11-0x00007FFF539F0000-0x00007FFF544B1000-memory.dmp

Filesize
10.8MB

Download
memory/3220-12-0x00007FFF539F0000-0x00007FFF544B1000-memory.dmp

Filesize
10.8MB

Download
memory/3220-15-0x00007FFF539F0000-0x00007FFF544B1000-memory.dmp

Filesize
10.8MB

Download
memory/3220-16-0x00007FFF539F0000-0x00007FFF544B1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads