Analysis
-
max time kernel
105s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
07/07/2023, 15:32
General
-
Target
Factura 1572023.exe
-
Size
892KB
-
MD5
4f310117d805982c98ab5f72b9d57226
-
SHA1
9b5893de7d40ec9383440baa7a05afc557e58a1d
-
SHA256
9c107eb970d14a5cb4e2232970451d0192b13bd87c7b231ac327bbafbacbb729
-
SHA512
62ca489401a3feb56527d0bec1e79cf98f7228d59af1ab6ac03f3eca8345a49c8c4f8cba0f1fbdfc227bd83cc32fee801e3ef126b777d04f4e28d4b5094e9f57
-
SSDEEP
24576:igjjk9YVRXPbYCwy7sRm6IvivgnwlLlMxleBpyeTV:HfVRXjxN7sRm6IagwlylCb
Score
10/10
Malware Config
Extracted
Family
darkcloud
C2
https://api.telegram.org/bot604988038:AAHbCIrKg0mPOZkWXVnoaV9KsVWEMxXjp0M/sendMessage?chat_id=2126102657
Signatures
-
DarkCloud
An information stealer written in Visual Basic.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura 1572023.exe"C:\Users\Admin\AppData\Local\Temp\Factura 1572023.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura 1572023.exe"C:\Users\Admin\AppData\Local\Temp\Factura 1572023.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
256KB
-
Filesize
920KB
-
Filesize
712KB
-
Filesize
48KB
-
Filesize
256KB
-
Filesize
48KB