Analysis
- max time kernel
153s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
31/07/2023, 13:12
General
- Target Order Inquiry.exe
- Size 795KB
- Sample230731-qfrdrafg65
- SHA256 4e0c4ff1b04d55403948acded8a2a584b869a984d1f846a18f52c6bd67631337
Malware Config
Extracted
-
darkcloud
- email_from
- email_to
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/220-142-0x0000000000400000-0x000000000046D000-memory.dmp
memory/220-149-0x0000000000400000-0x000000000046D000-memory.dmp
memory/220-145-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1268-136-0x0000000004D60000-0x0000000004DF2000-memory.dmp
memory/1268-137-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/1268-138-0x0000000004C50000-0x0000000004C5A000-memory.dmp
memory/1268-139-0x0000000074DB0000-0x0000000075560000-memory.dmp
memory/1268-140-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/1268-141-0x0000000007F90000-0x000000000802C000-memory.dmp
memory/1268-133-0x0000000074DB0000-0x0000000075560000-memory.dmp
memory/1268-135-0x0000000005270000-0x0000000005814000-memory.dmp
memory/1268-147-0x0000000074DB0000-0x0000000075560000-memory.dmp
memory/1268-134-0x00000000001D0000-0x000000000029E000-memory.dmp