darkvision | 05ab828d679c46e5ff03d3eba12474ef40342e25cffdb2ac967b7ebd81f188fe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2025, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

first-crypted.exe
Size

506KB
MD5

00bd099a7d2e003d4a0a5770209e211c
SHA1

ddf9433704d1f6e370df4e6f2a298ca35c0ccb8f
SHA256

05ab828d679c46e5ff03d3eba12474ef40342e25cffdb2ac967b7ebd81f188fe
SHA512

b29cffbbc3f8add6ca15ae22869712b3f10126492dc870163024682b7af105f4ae8a35838695494616440be99c0efd2f4e7e626e53b96a070015793431480883
SSDEEP

12288:7k2Jnp/pxuJSXde2cnr7zgmMAnnnnnnnnnnn+1111hWvjY:7Tnl7uJbznzgsnnnnnnnnnnn+1Bh5

Score

10^/10

darkvision rat

Malware Config

Extracted

Family

darkvision

162.250.190.150

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	svchostr64.exe

Executes dropped EXE 1 IoCs

pid	Process
5376	svchostr64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 5376	2412	first-crypted.exe	85
PID 2412 wrote to memory of 5376	2412	first-crypted.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\first-crypted.exe
"C:\Users\Admin\AppData\Local\Temp\first-crypted.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\ProgramData\Microsoft\svchostr64.exe
  "C:\ProgramData\Microsoft\svchostr64.exe" {922A3151-385B-4694-B75F-28A1329F31D0}
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\svchostr64.exe

Filesize
506KB

MD5
00bd099a7d2e003d4a0a5770209e211c

SHA1
ddf9433704d1f6e370df4e6f2a298ca35c0ccb8f

SHA256
05ab828d679c46e5ff03d3eba12474ef40342e25cffdb2ac967b7ebd81f188fe

SHA512
b29cffbbc3f8add6ca15ae22869712b3f10126492dc870163024682b7af105f4ae8a35838695494616440be99c0efd2f4e7e626e53b96a070015793431480883

Download Submit
memory/2412-0-0x0000000000980000-0x00000000009FB000-memory.dmp

Filesize
492KB

Download
memory/2412-1-0x00007FF4FDE10000-0x00007FF4FDE8B000-memory.dmp

Filesize
492KB

Download
memory/2412-8-0x00007FF4FDE10000-0x00007FF4FDE8B000-memory.dmp

Filesize
492KB

Download
memory/2412-7-0x0000000000980000-0x00000000009FB000-memory.dmp

Filesize
492KB

Download
memory/2412-5-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/5376-9-0x00007FF4FDE10000-0x00007FF4FDE8B000-memory.dmp

Filesize
492KB

Download
memory/5376-10-0x00007FF4FDE10000-0x00007FF4FDE8B000-memory.dmp

Filesize
492KB

Download
memory/5376-11-0x00007FF4FDE10000-0x00007FF4FDE8B000-memory.dmp

Filesize
492KB

Download
memory/5376-12-0x00007FF4FDE10000-0x00007FF4FDE8B000-memory.dmp

Filesize
492KB

Download
memory/5376-13-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download