Analysis
- max time kernel
142s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
29/07/2023, 17:09
General
- Target f3ce039a3fc5a7f12e2c5e2d7994cc4359b_JC.exe
- Size 946KB
- Sample230729-vpjsgsfb6v
- SHA256 f3ce039a3fc5a7f12e2c5e2d7994cc4359ba725d372eb804c8eea91f3fefe687
Malware Config
Extracted
-
darkcloud
-
https://api.telegram.org/bot6267068129:AAE4AO_gQGAeEakYl26r7KthrUjdWAdy5c0/sendMessage?chat_id=1909112828
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3ce039a3fc5a7f12e2c5e2d7994cc4359b_JC.exe"C:\Users\Admin\AppData\Local\Temp\f3ce039a3fc5a7f12e2c5e2d7994cc4359b_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f3ce039a3fc5a7f12e2c5e2d7994cc4359b_JC.exe"C:\Users\Admin\AppData\Local\Temp\f3ce039a3fc5a7f12e2c5e2d7994cc4359b_JC.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1744-139-0x0000000075130000-0x00000000758E0000-memory.dmp
memory/1744-134-0x0000000075130000-0x00000000758E0000-memory.dmp
memory/1744-135-0x0000000005730000-0x0000000005CD4000-memory.dmp
memory/1744-136-0x0000000005080000-0x0000000005112000-memory.dmp
memory/1744-137-0x0000000005340000-0x0000000005350000-memory.dmp
memory/1744-138-0x0000000005160000-0x000000000516A000-memory.dmp
memory/1744-133-0x00000000006D0000-0x00000000007C2000-memory.dmp
memory/1744-140-0x0000000005340000-0x0000000005350000-memory.dmp
memory/1744-141-0x000000000A5E0000-0x000000000A67C000-memory.dmp
memory/1744-148-0x0000000075130000-0x00000000758E0000-memory.dmp
memory/4016-142-0x0000000000400000-0x0000000000479000-memory.dmp
memory/4016-144-0x0000000000400000-0x0000000000479000-memory.dmp
memory/4016-149-0x0000000000400000-0x0000000000479000-memory.dmp