darkvision | 8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550

Analysis

max time kernel
145s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 17:54

Target
_8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550.exe
Size 756KB
Sample260604-wgzdmsb19n
SHA256 8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550
MD5 751670dfe61b3f3ab8b0174c9ab21e7d
SHA1 61fc9286b40e4e734cdfef75c91ec6a1194760d2
SHA512 b0e66eb2b2d25eeeca13ef5de3d0a71536b6d04d02ffd7b48c46205d610c85934cab0e1205b041a94c2a2e632ebd658e99117b582b770477a93501d742ccf334
SSDEEP 12288:gxlhj5UjLFlIZF93bgri1q9I/OTvhdbbBFPh23CV+SnrSLMr173iQHwMTpK:8lF5UjAFFb/qu/shdb1FPh23CVb2QpzB
TLSH
T192F42300F345AFE5E6614A74F0ABF28C12717F43FA99B5B7DAE898420C15B19FA1CC85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkvision rat

Family

Family: DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision

Executes dropped EXE 1 IoCs

pid	Process
2416	mybotonew.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	_8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550.exe
1888	_8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	_8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2416	1888	_8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550.exe	81

C:\Users\Admin\AppData\Local\Temp\_8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550.exe
"C:\Users\Admin\AppData\Local\Temp\_8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\mybotonew.exe
  "C:\Users\Admin\AppData\Local\Temp\mybotonew.exe"
  2⤵
  - Executes dropped EXE
  PID:2416

mybotonew.exe

Path C:\Users\Admin\AppData\Local\Temp\mybotonew.exe
Size 441KB
SHA256 e8a7d02e9073312e170080e9a4f32572d1d39f04624bf5b7c800e2f1dd88cd3d
MD5 048426a4914fa75594e02914e410594c
SHA1 a22c39142803281f989b926f714a4822e629caf1
SHA512 02f68e14b3ac125fc24a16e67a74b25ca30b0b27d42ec9f4138205feb51d524eced23dccf9e77ba64d72ed30a7bbf88db45d04a44c445d546f8e859ce4786655
SSDEEP 6144:EPDYVOXvcZu4oVp7y3BiTHKpASdlt+xW14HD:2YVOXT7yt1n14D
TLSH
T11FA4F847EB7550F4C876C0388AA26227B9717C5C5334ABDB8B508E521F23BE1E93EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1888-0-0x0000000000580000-0x0000000000644000-memory.dmp

Download

memory/1888-1-0x000000001BF60000-0x000000001BF70000-memory.dmp

Download

memory/1888-2-0x000000001BF70000-0x000000001C052000-memory.dmp

Download