Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2025, 11:18

General

  • Target

    99e56015a213e62d7ef8be81eb267702c743fb8e736950731e573fb96941bf97.exe

  • Size

    1.3MB

  • MD5

    c57914b63256088cb216b002d0cfcb33

  • SHA1

    c1d20451b8cbb0ee1da1ce42ff45deced2982838

  • SHA256

    99e56015a213e62d7ef8be81eb267702c743fb8e736950731e573fb96941bf97

  • SHA512

    1028e08b7b9705ac58a9d09a91bfe8c26a77e9b2b132dc3db87d98044d3f898db7ef03e9a3ad677f44909766ca4b7d449248143b6dcf3c79a33b7fe1b6b7aeaf

  • SSDEEP

    24576:Xu6J33O0c+JY5UZ+XC0kGso6Fa2/spmZvWDBNuotiDWY:xu0c++OCvkGs9Fa2/spIvWlNuoXY

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:
    ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Darkcloud family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99e56015a213e62d7ef8be81eb267702c743fb8e736950731e573fb96941bf97.exe
    "C:\Users\Admin\AppData\Local\Temp\99e56015a213e62d7ef8be81eb267702c743fb8e736950731e573fb96941bf97.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\99e56015a213e62d7ef8be81eb267702c743fb8e736950731e573fb96941bf97.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2688-11-0x0000000000220000-0x0000000000224000-memory.dmp

    Filesize

    16KB

  • memory/2692-12-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2692-14-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2692-17-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB