Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2023, 14:30

General

  • Target

    DHL AWB 38722187090.exe

  • Size

    914KB

  • MD5

    3232348d8f9aa98c80011580ae8d7c43

  • SHA1

    f7887c6ea74e9d435ea8a7764fca67cf388e7477

  • SHA256

    f2ae9306a48f1b446ce9467300267b864e8efe3f9e3b3d01da8bb89133140613

  • SHA512

    2728202d1d29ab4d13e3c5a77eaa5e95a1d5f39969bb260e05331b0828e4da3f242615c663ccf0a44f013f7edadc1581158506feb643c06e08b6f5b2891c956c

  • SSDEEP

    12288:H51qEww2d1mbTi5f6iB1YaZGMLxyAdLdE57Ry8iHs+t8PgaDZsoEJh3Y1EmXxDPJ:jqEw0CCiBDd6zBO8omiDotP1oMd

Score
10/10

Malware Config

Extracted

Family

darkcloud

Attributes

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL AWB 38722187090.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL AWB 38722187090.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Users\Admin\AppData\Local\Temp\DHL AWB 38722187090.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL AWB 38722187090.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2636-141-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2636-143-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2636-148-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/4308-133-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

  • memory/4308-134-0x00000000006D0000-0x00000000007BA000-memory.dmp

    Filesize

    936KB

  • memory/4308-135-0x00000000058A0000-0x0000000005E44000-memory.dmp

    Filesize

    5.6MB

  • memory/4308-136-0x00000000051B0000-0x0000000005242000-memory.dmp

    Filesize

    584KB

  • memory/4308-137-0x00000000053D0000-0x00000000053E0000-memory.dmp

    Filesize

    64KB

  • memory/4308-138-0x0000000005320000-0x000000000532A000-memory.dmp

    Filesize

    40KB

  • memory/4308-139-0x0000000005EF0000-0x0000000005F8C000-memory.dmp

    Filesize

    624KB

  • memory/4308-140-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB

  • memory/4308-147-0x00000000748D0000-0x0000000075080000-memory.dmp

    Filesize

    7.7MB