Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
31/07/2023, 06:55
General
- Target 533c8e6de7ac10fba06ffc98f41626f8e8af3fff7c16407463b37d84df239dcb.exe
- Size 401KB
- Sample230731-hptapsda77
- SHA256 533c8e6de7ac10fba06ffc98f41626f8e8af3fff7c16407463b37d84df239dcb
Malware Config
Extracted
-
darkcloud
-
https://api.telegram.org/bot6474909072:AAE35t_kjfFFVCPF7xcGUBipQxF6QCUotU/sendMessage?chat_id=1184359262
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\533c8e6de7ac10fba06ffc98f41626f8e8af3fff7c16407463b37d84df239dcb.exe"C:\Users\Admin\AppData\Local\Temp\533c8e6de7ac10fba06ffc98f41626f8e8af3fff7c16407463b37d84df239dcb.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
memory/3232-177-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-178-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-168-0x0000021158340000-0x0000021158341000-memory.dmp
memory/3232-169-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-170-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-171-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-204-0x00000211581E0000-0x00000211581E1000-memory.dmp
memory/3232-173-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-174-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-175-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-152-0x000002114FD50000-0x000002114FD60000-memory.dmp
memory/3232-172-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-185-0x0000021157F80000-0x0000021157F81000-memory.dmp
memory/3232-179-0x0000021157F90000-0x0000021157F91000-memory.dmp
memory/3232-180-0x0000021157F80000-0x0000021157F81000-memory.dmp
memory/3232-182-0x0000021157F90000-0x0000021157F91000-memory.dmp
memory/3232-176-0x0000021158360000-0x0000021158361000-memory.dmp
memory/3232-188-0x0000021157EC0000-0x0000021157EC1000-memory.dmp
memory/3232-136-0x000002114FC50000-0x000002114FC60000-memory.dmp
memory/3232-200-0x00000211580C0000-0x00000211580C1000-memory.dmp
memory/3232-202-0x00000211580D0000-0x00000211580D1000-memory.dmp
memory/3232-203-0x00000211580D0000-0x00000211580D1000-memory.dmp
memory/4488-133-0x0000000000400000-0x0000000000466EEC-memory.dmp
memory/4488-205-0x0000000000400000-0x0000000000466EEC-memory.dmp