Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2025, 09:05

General

  • Target

    FACTURA DE ENVIO DE DHL.exe

  • Size

    522KB

  • MD5

    01520fc80bd96941d4d080e7f6e623e5

  • SHA1

    ff132ad4e6f7e41b5bc82a0e0de52950cc906b06

  • SHA256

    ecbdaea604f259a7535b32c7abcd25139af9b8abe04a45d24614212c9d8ea67c

  • SHA512

    b90c50ed06f439940dac865bee34a925c8be1101ff6ee3ced37dfd701046f53bbc064488ef0da0b812c894e7af104289d5c1d5aa7afc82c9103879357fe3360c

  • SSDEEP

    6144:CoXuKg0NWPnxDxFJ+6NlW9/2NEB2z2GoU3AI85SizO8887dI+IkEWh+E:Co+qNWPnxtNA9/mK2aC8886+

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:
    ftp
  • Host:
    @StrFtpServer
  • Port:
    21
  • Username:
    @StrFtpUser
  • Password:
    @StrFtpPass

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Darkcloud family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVIO DE DHL.exe
        "C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVIO DE DHL.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops startup file
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2216
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4860

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2216-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

      Filesize

      4KB

    • memory/2216-1-0x0000000000CF0000-0x0000000000D78000-memory.dmp

      Filesize

      544KB

    • memory/2216-2-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2216-3-0x0000000005F30000-0x0000000006064000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-4-0x0000000006630000-0x0000000006BD4000-memory.dmp

      Filesize

      5.6MB

    • memory/2216-5-0x0000000006180000-0x0000000006212000-memory.dmp

      Filesize

      584KB

    • memory/2216-9-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-55-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-69-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-67-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-65-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-63-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-61-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-59-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-57-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-53-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-51-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-49-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-47-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-45-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-41-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-39-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-37-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-43-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-35-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-31-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-29-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-27-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-25-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-23-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-19-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-17-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-15-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-13-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-11-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-7-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-6-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-33-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-21-0x0000000005F30000-0x000000000605E000-memory.dmp

      Filesize

      1.2MB

    • memory/2216-1328-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2216-1329-0x00000000063D0000-0x00000000063D6000-memory.dmp

      Filesize

      24KB

    • memory/2216-1330-0x00000000063F0000-0x000000000647E000-memory.dmp

      Filesize

      568KB

    • memory/2216-1331-0x0000000006480000-0x000000000650A000-memory.dmp

      Filesize

      552KB

    • memory/2216-1332-0x0000000006580000-0x00000000065CC000-memory.dmp

      Filesize

      304KB

    • memory/2216-1333-0x0000000006CE0000-0x0000000006D34000-memory.dmp

      Filesize

      336KB

    • memory/2216-1341-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2216-1339-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2216-1342-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2216-1346-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4860-1347-0x0000000000400000-0x0000000000459000-memory.dmp

      Filesize

      356KB

    • memory/4860-1358-0x0000000000400000-0x0000000000459000-memory.dmp

      Filesize

      356KB