Analysis
- max time kernel
148s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
30/09/2025, 16:34
General
- Target SecuriteInfo.com.Trojan.Siggen31.58950.24932.31504.exe
- Size 815KB
- Sample250930-t29c8szzcx
- SHA256 a1bb869c7bc1c929b59fd85525edcbff01c2ae37047f796dcf128aa92284422c
Malware Config
Extracted
-
darkcloud
- email_from
- email_to
-
host_password
0U+Ns[M60Jg!
-
host_server
fiber23-R.iaasdns.com
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen31.58950.24932.31504.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen31.58950.24932.31504.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iHhllRy.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iHhllRy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB98C.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_okkddwgd.llr.ps1
tmpB98C.tmp
LoginData
WebData
memory/1016-66-0x0000000000400000-0x0000000000449000-memory.dmp
memory/1016-17-0x0000000000400000-0x0000000000449000-memory.dmp
memory/1016-15-0x0000000000400000-0x0000000000449000-memory.dmp
memory/1268-33-0x0000000005D10000-0x0000000005D2E000-memory.dmp
memory/1268-45-0x0000000006F10000-0x0000000006F2E000-memory.dmp
memory/1268-63-0x00000000073B0000-0x00000000073B8000-memory.dmp
memory/1268-14-0x0000000005000000-0x000000000562A000-memory.dmp
memory/1268-62-0x00000000073C0000-0x00000000073DA000-memory.dmp
memory/1268-61-0x00000000072C0000-0x00000000072D5000-memory.dmp
memory/1268-21-0x0000000004E80000-0x0000000004EA2000-memory.dmp
memory/1268-22-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/1268-23-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/1268-60-0x00000000072B0000-0x00000000072BE000-memory.dmp
memory/1268-32-0x00000000058E0000-0x0000000005C37000-memory.dmp
memory/1268-59-0x0000000007280000-0x0000000007291000-memory.dmp
memory/1268-34-0x0000000005D50000-0x0000000005D9C000-memory.dmp
memory/1268-35-0x0000000006ED0000-0x0000000006F04000-memory.dmp
memory/1268-36-0x0000000070490000-0x00000000704DC000-memory.dmp
memory/1268-12-0x0000000004860000-0x0000000004896000-memory.dmp
memory/1268-46-0x0000000006F30000-0x0000000006FD4000-memory.dmp
memory/1268-55-0x00000000076B0000-0x0000000007D2A000-memory.dmp
memory/1268-56-0x0000000007070000-0x000000000708A000-memory.dmp
memory/1268-57-0x00000000070F0000-0x00000000070FA000-memory.dmp
memory/1268-58-0x0000000007300000-0x0000000007396000-memory.dmp
memory/1888-0-0x0000000000210000-0x00000000002DE000-memory.dmp
memory/1888-4-0x0000000004F20000-0x0000000004F2A000-memory.dmp
memory/1888-5-0x0000000005070000-0x000000000510C000-memory.dmp
memory/1888-6-0x0000000005040000-0x0000000005058000-memory.dmp
memory/1888-7-0x00000000051E0000-0x0000000005274000-memory.dmp
memory/1888-3-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/1888-2-0x0000000004D90000-0x0000000004E22000-memory.dmp
memory/1888-1-0x00000000052A0000-0x0000000005846000-memory.dmp