Analysis
- max time kernel
136s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
17/01/2023, 14:05
General
- Target LNH_-_Tape_Library_5130868542-01_Commercials.exe
- Size 1.0MB
- Sample230117-rdtxjadb7y
- SHA256 ec4aa8a64d9d8e0591d04f1bbe057fd665df8d9c083bd4070f4326862b1753d6
Score
10/10
Malware Config
Extracted
Family
-
darkcloud
Attributes
- email_from
- email_to
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LNH_-_Tape_Library_5130868542-01_Commercials.exe"C:\Users\Admin\AppData\Local\Temp\LNH_-_Tape_Library_5130868542-01_Commercials.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LNH_-_Tape_Library_5130868542-01_Commercials.exe"C:\Users\Admin\AppData\Local\Temp\LNH_-_Tape_Library_5130868542-01_Commercials.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2116-138-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2116-140-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2116-143-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2116-144-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2836-132-0x0000000000AA0000-0x0000000000BB0000-memory.dmp
memory/2836-133-0x0000000005AB0000-0x0000000006054000-memory.dmp
memory/2836-134-0x0000000005450000-0x00000000054E2000-memory.dmp
memory/2836-135-0x00000000053D0000-0x00000000053DA000-memory.dmp
memory/2836-136-0x00000000056A0000-0x000000000573C000-memory.dmp