Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18-01-2024 06:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64b4db1046496c57a0779befc72c264d.exe
Resource
win7-20231215-en
5 signatures
150 seconds
General
-
Target
64b4db1046496c57a0779befc72c264d.exe
-
Size
448KB
-
MD5
64b4db1046496c57a0779befc72c264d
-
SHA1
71cfbee47a5b6f0bb18bba914b5896b3037cfeab
-
SHA256
d5e0eecc3da1a2bc3f36df0a05c0ce116def64c9e6c72224c8988a671ed7fe8a
-
SHA512
d59bf100032299d10e6737d9489202545ce4cf3b403407da0ba0fbbd0f72b502478ce3557008ad785e146041a100e2e48ba1d9414a983d954cea7437c424f3da
-
SSDEEP
12288:4NO4tKQaWEkJsUy2H5ZhLvWmyN/En9C5:MtKQaTkJs0LemI49
Malware Config
Signatures
-
DarkVNC payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-3-0x00000000002A0000-0x0000000000328000-memory.dmp darkvnc behavioral1/memory/2916-4-0x0000000000400000-0x0000000002CA6000-memory.dmp darkvnc behavioral1/memory/2684-6-0x0000000001D00000-0x0000000001DCA000-memory.dmp darkvnc behavioral1/memory/2684-11-0x0000000001D00000-0x0000000001DCA000-memory.dmp darkvnc behavioral1/memory/2684-12-0x0000000001D00000-0x0000000001DCA000-memory.dmp darkvnc behavioral1/memory/2684-13-0x0000000001D00000-0x0000000001DCA000-memory.dmp darkvnc behavioral1/memory/2684-14-0x0000000001D00000-0x0000000001DCA000-memory.dmp darkvnc behavioral1/memory/2916-15-0x0000000000400000-0x0000000002CA6000-memory.dmp darkvnc behavioral1/memory/2684-16-0x0000000001D00000-0x0000000001DCA000-memory.dmp darkvnc -
Suspicious use of SetThreadContext 1 IoCs
Processes:
64b4db1046496c57a0779befc72c264d.exedescription pid process target process PID 2916 set thread context of 2684 2916 64b4db1046496c57a0779befc72c264d.exe WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
64b4db1046496c57a0779befc72c264d.exepid process 2916 64b4db1046496c57a0779befc72c264d.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
64b4db1046496c57a0779befc72c264d.exedescription pid process target process PID 2916 wrote to memory of 2684 2916 64b4db1046496c57a0779befc72c264d.exe WerFault.exe PID 2916 wrote to memory of 2684 2916 64b4db1046496c57a0779befc72c264d.exe WerFault.exe PID 2916 wrote to memory of 2684 2916 64b4db1046496c57a0779befc72c264d.exe WerFault.exe PID 2916 wrote to memory of 2684 2916 64b4db1046496c57a0779befc72c264d.exe WerFault.exe PID 2916 wrote to memory of 2684 2916 64b4db1046496c57a0779befc72c264d.exe WerFault.exe PID 2916 wrote to memory of 2684 2916 64b4db1046496c57a0779befc72c264d.exe WerFault.exe PID 2916 wrote to memory of 2684 2916 64b4db1046496c57a0779befc72c264d.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64b4db1046496c57a0779befc72c264d.exe"C:\Users\Admin\AppData\Local\Temp\64b4db1046496c57a0779befc72c264d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2684-6-0x0000000001D00000-0x0000000001DCA000-memory.dmpFilesize
808KB
-
memory/2684-5-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmpFilesize
4KB
-
memory/2684-8-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2684-11-0x0000000001D00000-0x0000000001DCA000-memory.dmpFilesize
808KB
-
memory/2684-12-0x0000000001D00000-0x0000000001DCA000-memory.dmpFilesize
808KB
-
memory/2684-13-0x0000000001D00000-0x0000000001DCA000-memory.dmpFilesize
808KB
-
memory/2684-14-0x0000000001D00000-0x0000000001DCA000-memory.dmpFilesize
808KB
-
memory/2684-16-0x0000000001D00000-0x0000000001DCA000-memory.dmpFilesize
808KB
-
memory/2916-1-0x0000000002D20000-0x0000000002E20000-memory.dmpFilesize
1024KB
-
memory/2916-3-0x00000000002A0000-0x0000000000328000-memory.dmpFilesize
544KB
-
memory/2916-4-0x0000000000400000-0x0000000002CA6000-memory.dmpFilesize
40.6MB
-
memory/2916-15-0x0000000000400000-0x0000000002CA6000-memory.dmpFilesize
40.6MB