Analysis
- max time kernel
61s - max time network
44s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
25/01/2023, 05:54
General
- Target Order 1007165.exe
- Size 875KB
- Sample230125-glv5fsfa64
- SHA256 ddfc0507ced17d04d1c63ad261716af41bb49b0699ad2b59ed4699fc689503ed
Malware Config
Extracted
-
darkcloud
- email_from
- email_to
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order 1007165.exe"C:\Users\Admin\AppData\Local\Temp\Order 1007165.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order 1007165.exe"C:\Users\Admin\AppData\Local\Temp\Order 1007165.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1456-54-0x0000000000B60000-0x0000000000C42000-memory.dmp
memory/1456-55-0x00000000768A1000-0x00000000768A3000-memory.dmp
memory/1456-56-0x0000000000480000-0x0000000000496000-memory.dmp
memory/1456-57-0x00000000004A0000-0x00000000004AA000-memory.dmp
memory/1456-58-0x0000000005320000-0x00000000053BC000-memory.dmp
memory/1456-59-0x0000000004FD0000-0x0000000005036000-memory.dmp
memory/1796-60-0x0000000000400000-0x0000000000460000-memory.dmp
memory/1796-61-0x0000000000400000-0x0000000000460000-memory.dmp
memory/1796-66-0x0000000000400000-0x0000000000460000-memory.dmp
memory/1796-63-0x0000000000400000-0x0000000000460000-memory.dmp
memory/1796-69-0x0000000000400000-0x0000000000460000-memory.dmp
memory/1796-72-0x0000000000400000-0x0000000000460000-memory.dmp
memory/1796-73-0x0000000000400000-0x0000000000460000-memory.dmp