Analysis
- max time kernel
103s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
12/08/2025, 16:44
General
- Target 5c15cd19a2df5d2b56e4f16a8ffaa0ea0573869e5191ec53d959b69c37239aa8.exe
- Size 1018KB
- Sample250812-t88ehsfj8s
- SHA256 5c15cd19a2df5d2b56e4f16a8ffaa0ea0573869e5191ec53d959b69c37239aa8
Malware Config
Extracted
-
darkcloud
-
Protocol
ftp
-
Host
ftp.ics-comms.com
-
Port
21
-
Username
-
Password
gXhag5KO65vM2lCQ
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c15cd19a2df5d2b56e4f16a8ffaa0ea0573869e5191ec53d959b69c37239aa8.exe"C:\Users\Admin\AppData\Local\Temp\5c15cd19a2df5d2b56e4f16a8ffaa0ea0573869e5191ec53d959b69c37239aa8.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5c15cd19a2df5d2b56e4f16a8ffaa0ea0573869e5191ec53d959b69c37239aa8.exe"C:\Users\Admin\AppData\Local\Temp\5c15cd19a2df5d2b56e4f16a8ffaa0ea0573869e5191ec53d959b69c37239aa8.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3528-12-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3528-19-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3528-16-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4244-6-0x0000000005CC0000-0x0000000005CD2000-memory.dmp
memory/4244-4-0x0000000005A70000-0x0000000005A7A000-memory.dmp
memory/4244-5-0x0000000006FA0000-0x00000000072F4000-memory.dmp
memory/4244-0-0x0000000000DE0000-0x0000000000EE4000-memory.dmp
memory/4244-7-0x0000000007770000-0x0000000007792000-memory.dmp
memory/4244-8-0x0000000007750000-0x0000000007762000-memory.dmp
memory/4244-9-0x0000000005B50000-0x0000000005B60000-memory.dmp
memory/4244-10-0x0000000007BD0000-0x0000000007C8E000-memory.dmp
memory/4244-11-0x000000000A300000-0x000000000A39C000-memory.dmp
memory/4244-3-0x0000000005B50000-0x0000000005B60000-memory.dmp
memory/4244-2-0x00000000058D0000-0x0000000005962000-memory.dmp
memory/4244-1-0x0000000005E80000-0x0000000006424000-memory.dmp