Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
25/07/2023, 14:20
General
- Target NA_262531be1dc4d521469be8ff7_JC.exe
- Size 1019KB
- Sample230725-rnqb4ach77
- SHA256 262531be1dc4d521469be8ff7591f9d40861bcf7de7ff4f8a0ee1ba542713c0d
Malware Config
Extracted
-
darkcloud
- email_from
- email_to
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_262531be1dc4d521469be8ff7_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_262531be1dc4d521469be8ff7_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NA_262531be1dc4d521469be8ff7_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_262531be1dc4d521469be8ff7_JC.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/444-139-0x0000000005070000-0x000000000510C000-memory.dmp
memory/444-134-0x00000000002C0000-0x00000000003C6000-memory.dmp
memory/444-135-0x0000000005390000-0x0000000005934000-memory.dmp
memory/444-136-0x0000000004DE0000-0x0000000004E72000-memory.dmp
memory/444-137-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/444-138-0x0000000004DC0000-0x0000000004DCA000-memory.dmp
memory/444-133-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/444-140-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/444-141-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/444-147-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/1900-142-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1900-145-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1900-149-0x0000000000400000-0x000000000046D000-memory.dmp