Analysis
-
max time kernel
297s -
max time network
212s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
17/04/2025, 08:34
General
-
Target
PRICE DOCUMENT.exe
-
Size
741KB
-
MD5
cbd2adf469c63fc4dc5c324b8185fc65
-
SHA1
8207dfb884f8eebc1dace7fb3fb61de0a824b45b
-
SHA256
69b5131e236cf15dc4ccb40c937ea0aa077d6b50c1bf05430a65f1999b5bb0e9
-
SHA512
5638b5ed3ecb7647a8c7bddaff10dcbef5d4aed9370c288f6e3d513e6f5b7d3057275f1ec820efcabf53cdf8b1c061743d6ee29e7f72785b06becf87cee9516f
-
SSDEEP
12288:jGYhNEFqmqt0xdOZC6m4/OUFL8u/0tTB/F9bomOvnEKELo2HT1lDAY6NhOdz:jGYXu80gZCTWFkNFZKvnVi5hA3Odz
Malware Config
Signatures
-
DarkCloud
An information stealer written in Visual Basic.
-
Darkcloud family
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRICE DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\PRICE DOCUMENT.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PRICE DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\PRICE DOCUMENT.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD56f5257c0b8c0ef4d440f4f4fce85fb1b
SHA1b6ac111dfb0d1fc75ad09c56bde7830232395785
SHA256b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
SHA512a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
-
Filesize
1KB
MD5c4631f521f71fc0e854738b9fc4f1198
SHA18e1276c5a242e890d0febb12df5d7a3119427567
SHA256da5b3fd7e5ea98bf5d03191aa661326aec6e0ebd22153da103b2cf2241231d28
SHA512a2ffd6bb4b71c4f7a69edc85e78898465ded0cfeff3773bfe967470e38635c4e40e4ac46cd30025c0abd4d7e2b0a03dd0a689cac4a1340d5e910b0a66a11945f
-
Filesize
24B
MD598a833e15d18697e8e56cdafb0642647
SHA1e5f94d969899646a3d4635f28a7cd9dd69705887
SHA256ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c
SHA512c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b
-
Filesize
36B
MD59f26c215597c6d215332812cb96823de
SHA1e38d33b223894281f48585d5ee4a3cfaa8a69b2f
SHA25631ce0e20e2e3d6047008df8b1186381728ecbe32cbdb1d8528e966c6ff79a8be
SHA512cf84962ab1e33b580ec7acbc848f944ca2da16a21743225d60dd759d4df09de93e05255e64de5edf1369aa7ad8647a3cc748ab7247b215939f3b46ca493eeb0a
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
25.7MB
-
Filesize
18.3MB
-
Filesize
25.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
25.7MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
25.7MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
25.7MB
-
Filesize
1.1MB