Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
07-08-2023 07:53
General
-
Target
83d500829f43f092f92aa54f4cf3d5cb9bcf390b27e06342cc6b387e5a626992.exe
-
Size
470KB
-
MD5
efc32f9fae7168916be229983266926b
-
SHA1
5b0c20ec6f3bc14e7b4fe674deaa0a8de0593b39
-
SHA256
83d500829f43f092f92aa54f4cf3d5cb9bcf390b27e06342cc6b387e5a626992
-
SHA512
29d2db0f38195c352ac5af1be62de0a267de094a31b8088bcaf87415eee065da01e6646b5689b5c18c5b8873e1aa0e366af4cc918ff18112b71af925974ee1da
-
SSDEEP
12288:FSmMj6NRC7oI/ItgP2xAOld+P4GiRGdJjYKkJj6GmZU:m6NwoM4d+P4GiR0xYb6nZ
Score
10/10
Malware Config
Extracted
Family
darkcloud
C2
https://api.telegram.org/bot1934251866:AAHQ4gMhLxMk3PU1o074pz2lcaY8-WjTQb4/sendMessage?chat_id=1644584536
Signatures
-
DarkCloud
An information stealer written in Visual Basic.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83d500829f43f092f92aa54f4cf3d5cb9bcf390b27e06342cc6b387e5a626992.exe"C:\Users\Admin\AppData\Local\Temp\83d500829f43f092f92aa54f4cf3d5cb9bcf390b27e06342cc6b387e5a626992.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
479KB
-
Filesize
479KB