Analysis
-
max time kernel
118s -
max time network
155s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09/08/2021, 08:52
General
-
Target
no_startup_upd_2021-08-09_05-28.exe
-
Size
448KB
-
MD5
2d0b8663c370b76694a77d6ce5f3897c
-
SHA1
f803c6a204231bf80b8ee47912c43d597dbfda8f
-
SHA256
bfec5909532fa13fa9e1a2ef05a6d053c44a6aae7f75715bd6f8b0c6264e7330
-
SHA512
837d15e30285cdc0b8935bb1f72d06e2c9cd96423dffd81586ed692d27a432496c9da8413c8f356a9be02cb53f9fddd967f724f17799169baf0465ddce49388d
Score
10/10
Malware Config
Signatures
-
DarkVNC
DarkVNC is a malicious version of the famous VNC software.
-
DarkVNC Payload 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\no_startup_upd_2021-08-09_05-28.exe"C:\Users\Admin\AppData\Local\Temp\no_startup_upd_2021-08-09_05-28.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
40.6MB
-
Filesize
544KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
808KB