Analysis
-
max time kernel
137s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24/01/2024, 17:41
General
-
Target
DHL AWB TRACKING DETAILS.exe
-
Size
866KB
-
MD5
5e8251350f619a486b4837dd4e41c7e1
-
SHA1
821494ab9e38414778ee4f17c771f79e3d4093a4
-
SHA256
3b4e3532a40eca44a5d89734e3fa567e88cdda066bcd7048172a5e1f95c8781f
-
SHA512
49ffb4b88718554906872201ddac704d0099f71fe4c6ceb1b8133817384dbb1716844e0ea9412abac5219b80b768ec9f80c198dc111c7413b030184c7a723209
-
SSDEEP
24576:O0m+XZZcgETYgDEPHWh0MfHdGFi7vGyEJZsF4BNysMi:O0vpZFETPIHMww7vlwZLBNy7i
Score
10/10
Malware Config
Extracted
Family
darkcloud
Attributes
- email_from
- email_to
Signatures
-
DarkCloud
An information stealer written in Visual Basic.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB TRACKING DETAILS.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
32KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
696KB
-
Filesize
48KB
-
Filesize
6.9MB
-
Filesize
96KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
888KB