Analysis
- max time kernel
145s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
13/08/2023, 09:05
General
- Target 09369024c94191a83d2cfa5bcac018aef525f46cff33c001dcfcd6bb78e1b520_JC.exe
- Size 979KB
- Sample230813-k2k6zaaa73
- SHA256 09369024c94191a83d2cfa5bcac018aef525f46cff33c001dcfcd6bb78e1b520
Malware Config
Extracted
-
darkcloud
- email_from
- email_to
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09369024c94191a83d2cfa5bcac018aef525f46cff33c001dcfcd6bb78e1b520_JC.exe"C:\Users\Admin\AppData\Local\Temp\09369024c94191a83d2cfa5bcac018aef525f46cff33c001dcfcd6bb78e1b520_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09369024c94191a83d2cfa5bcac018aef525f46cff33c001dcfcd6bb78e1b520_JC.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1700-143-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1700-150-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1700-146-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4928-139-0x0000000005880000-0x000000000588A000-memory.dmp
memory/4928-137-0x0000000005900000-0x0000000005992000-memory.dmp
memory/4928-138-0x0000000005700000-0x0000000005710000-memory.dmp
memory/4928-134-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/4928-140-0x0000000005AF0000-0x0000000005B46000-memory.dmp
memory/4928-141-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/4928-142-0x0000000005700000-0x0000000005710000-memory.dmp
memory/4928-136-0x0000000005E10000-0x00000000063B4000-memory.dmp
memory/4928-135-0x00000000057C0000-0x000000000585C000-memory.dmp
memory/4928-148-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/4928-133-0x0000000000CE0000-0x0000000000DDC000-memory.dmp