Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-01-2025 13:35
General
-
Target
PAYMENTS.EXE.exe
-
Size
4.0MB
-
MD5
8fd42c8e20fd0d2bea21bbb085071a9b
-
SHA1
226135f8d9a8b9d7d326f9056a2ec8ef29c2dd79
-
SHA256
72e97fb5034c58f98b9faa58766a515374b5cde6433b14380cdefa694652f524
-
SHA512
bb1c8b61380f65d55e8edadc54ae694c6a8a26f8e0b28c09d775f2a67cf7230005bc3d70e81660ebd9345bc08a94ccd851dcd92780cba730fb7698da27c51781
-
SSDEEP
49152:NE6nkDXO+T4MNxdsLC+1qzIyq/6z7LSIrQmRiHFw8SHGggklJnh81NRvAe:9nkPqx6O6zSkZRiHLSHGggkl9mAe
Score
10/10
Malware Config
Extracted
Family
darkvision
C2
engvisited101.ddns.net
Signatures
-
DarkVision Rat
DarkVision Rat is a trojan written in C++.
-
Darkvision family
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENTS.EXE.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENTS.EXE.exe"1⤵
- Checks BIOS information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
8KB