Analysis
-
max time kernel
150s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
06/12/2022, 03:34
General
-
Target
SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
-
Size
1.0MB
-
MD5
263a424481c45e0340bd95f6f26570bb
-
SHA1
74fb7027fb40ff3fd18fdc2ad6c40c76fa9cb258
-
SHA256
3aa2bf0cfa371eed74387aabf5fb54840747c3b79d5eeb632c8f8ed7a7932645
-
SHA512
1e6c3cb5f6338fd3a8d7468827d1da9e6c733aae27673b737fd7d15632a0b3b6e0d3799d015aeb85990d7d404b6cbb206971eb5a78ecd4f68d5506243f2463ef
-
SSDEEP
12288:qcX8QJkULm8TZMXwZ96+PiOIQvRfWq/yAPMR8NTSE3UI72X+isjma3gKZ/nXt7vj:pSUrT/Z0+VRfl6/R8LEI7GW
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot5637426169:AAH_P4-KucbNFzwchy84SCbxibLRynyCwuA/sendMessage?chat_id=5323697986
Signatures
-
DarkCloud
An information stealer written in Visual Basic.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kXpmjJRxZYTok.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kXpmjJRxZYTok" /XML "C:\Users\Admin\AppData\Local\Temp\tmp875A.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD597df77e74246f2d5f7e7aabff19f9b2a
SHA180a5684b73f90bd5c0b31004fd7bba1004d5f26d
SHA2563cc9a3d79f5a505ac0eae28c3042b1c85c332478a3323f276d5a3a15ca38cec5
SHA5122cda3f9c66e53e735a4572d381be3d08caffd9cf6f5ba4223c07cf21083f43a79f4d0585bcd14055567b5e08fb93453c1d06a1b810b41406bee8de228cd70e19
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
688KB
-
Filesize
472KB
-
Filesize
1.0MB
-
Filesize
56KB
-
Filesize
88KB
-
Filesize
8KB