darkvision | 0b2f7eb45c4eede5a3cfe9d47ce56865caaac0339b345fd0801611e93db665de

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/03/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SbieDll.dll
Size 15.3MB
Sample260310-exdcnsay9w
SHA256 0b2f7eb45c4eede5a3cfe9d47ce56865caaac0339b345fd0801611e93db665de
MD5 f44b9c97ed9ac03f4a3c21854430a341
SHA1 ca4db130a49be215909ff15513ceba91fe5c067a
SHA512 9a6c768fcb15dc6494a96e56e66665ee33a970dbefc82fc58b36559b7484f1b7f20d3565c620100625368b88ff14672fd926722746848b58d6607c96e1a29848
SSDEEP 98304:3jccBR1X721QV/2tNWfCgbS0QRKFxxtcLy9NgS14nE:3gcBn5eNg/buRy9cLy9w
TLSH
T162F63A70C39151A1D197C470CE954FF865E1787B803A5D0D1AC4F8AA3AFEF21AF9D2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkvision rat

Malware Config

Extracted

Family

darkvision

45.88.91.153

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4504 set thread context of 3904	4504	rundll32.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3904	4504	rundll32.exe	80
PID 4504 wrote to memory of 3904	4504	rundll32.exe	80
PID 4504 wrote to memory of 3904	4504	rundll32.exe	80
PID 4504 wrote to memory of 3904	4504	rundll32.exe	80
PID 4504 wrote to memory of 3904	4504	rundll32.exe	80
PID 4504 wrote to memory of 3904	4504	rundll32.exe	80
PID 4504 wrote to memory of 3904	4504	rundll32.exe	80
PID 4504 wrote to memory of 3904	4504	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SbieDll.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3904-0-0x0000000140000000-0x0000000140080000-memory.dmp

Download

memory/3904-2-0x0000000140000000-0x0000000140080000-memory.dmp

Download

memory/3904-4-0x0000000140000000-0x0000000140080000-memory.dmp

Download

memory/3904-3-0x0000000140000000-0x0000000140080000-memory.dmp

Download

memory/3904-5-0x0000000140000000-0x0000000140080000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads