Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
27/05/2026, 12:14
General
- Target Quotation No 550.exe
- Size 1.3MB
- Sample260527-peg81sft4y
- SHA256 82f667e77a036edce6b6bef25fbc989fbf1f27e1bdc3ddb99b821ca9f60dd10b
Malware Config
Extracted
-
darkcloud
- email_from
- email_to
Signatures
- Family: DarkCloud
An information stealer written in Visual Basic.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation No 550.exe"C:\Users\Admin\AppData\Local\Temp\Quotation No 550.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\Quotation No 550.exe\:Zone.Identifier"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1640-13-0x0000000000400000-0x000000000046C000-memory.dmp
memory/1640-12-0x0000000000400000-0x000000000046C000-memory.dmp
memory/4252-6-0x0000000004F80000-0x0000000004F8A000-memory.dmp
memory/4252-3-0x0000000004E20000-0x0000000004EBC000-memory.dmp
memory/4252-4-0x0000000004D10000-0x0000000004D40000-memory.dmp
memory/4252-5-0x0000000005000000-0x0000000005010000-memory.dmp
memory/4252-0-0x0000000000140000-0x000000000028C000-memory.dmp
memory/4252-7-0x0000000006E00000-0x0000000006E0C000-memory.dmp
memory/4252-8-0x0000000005000000-0x0000000005010000-memory.dmp
memory/4252-9-0x0000000005000000-0x0000000005010000-memory.dmp
memory/4252-10-0x0000000005000000-0x0000000005010000-memory.dmp
memory/4252-11-0x00000000063E0000-0x00000000063EE000-memory.dmp
memory/4252-2-0x0000000004D80000-0x0000000004E12000-memory.dmp
memory/4252-1-0x0000000005330000-0x00000000058D6000-memory.dmp