darkcloud | 3aa2bf0cfa371eed74387aabf5fb54840747c3b79d5eeb632c8f8ed7a7932645

General

Target

SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
Size

1.0MB
MD5

263a424481c45e0340bd95f6f26570bb
SHA1

74fb7027fb40ff3fd18fdc2ad6c40c76fa9cb258
SHA256

3aa2bf0cfa371eed74387aabf5fb54840747c3b79d5eeb632c8f8ed7a7932645
SHA512

1e6c3cb5f6338fd3a8d7468827d1da9e6c733aae27673b737fd7d15632a0b3b6e0d3799d015aeb85990d7d404b6cbb206971eb5a78ecd4f68d5506243f2463ef
SSDEEP

12288:qcX8QJkULm8TZMXwZ96+PiOIQvRfWq/yAPMR8NTSE3UI72X+isjma3gKZ/nXt7vj:pSUrT/Z0+VRfl6/R8LEI7GW

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5637426169:AAH_P4-KucbNFzwchy84SCbxibLRynyCwuA/sendMessage?chat_id=5323697986

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
1800	powershell.exe
1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
1800	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
Token: SeDebugPrivilege	1800	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2792	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1800	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	84
PID 1960 wrote to memory of 1800	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	84
PID 1960 wrote to memory of 1800	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	84
PID 1960 wrote to memory of 4552	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	86
PID 1960 wrote to memory of 4552	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	86
PID 1960 wrote to memory of 4552	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	86
PID 1960 wrote to memory of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88
PID 1960 wrote to memory of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88
PID 1960 wrote to memory of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88
PID 1960 wrote to memory of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88
PID 1960 wrote to memory of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88
PID 1960 wrote to memory of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88
PID 1960 wrote to memory of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88
PID 1960 wrote to memory of 2792	1960	SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe	88

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kXpmjJRxZYTok.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kXpmjJRxZYTok" /XML "C:\Users\Admin\AppData\Local\Temp\tmp346E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Crypt.8892.8543.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp346E.tmp

Filesize
1KB

MD5
935b2320f6d687e499eec5f5fe53ece0

SHA1
c36d15391895e91f06827fc654c96598cb21dac9

SHA256
15baf4b8fe1ff8821b031d082474452bfca8c683e02cfdad296dfab1dd123fe4

SHA512
1e429dcf868c435859b89a07a42e07f814a49c26c2b5156c0fc53a06ae054855aa82d0640ed12d29f86102f9138c832aed7d90b3e74870f3f0154e1cb230dcc3

Download Submit
memory/1800-156-0x0000000007CB0000-0x000000000832A000-memory.dmp

Filesize
6.5MB

Download
memory/1800-155-0x0000000006910000-0x000000000692E000-memory.dmp

Filesize
120KB

Download
memory/1800-162-0x0000000007980000-0x0000000007988000-memory.dmp

Filesize
32KB

Download
memory/1800-161-0x00000000079A0000-0x00000000079BA000-memory.dmp

Filesize
104KB

Download
memory/1800-143-0x0000000005370000-0x0000000005392000-memory.dmp

Filesize
136KB

Download
memory/1800-160-0x0000000007890000-0x000000000789E000-memory.dmp

Filesize
56KB

Download
memory/1800-139-0x0000000004DA0000-0x0000000004DD6000-memory.dmp

Filesize
216KB

Download
memory/1800-158-0x00000000076E0000-0x00000000076EA000-memory.dmp

Filesize
40KB

Download
memory/1800-141-0x0000000005560000-0x0000000005B88000-memory.dmp

Filesize
6.2MB

Download
memory/1800-157-0x0000000007660000-0x000000000767A000-memory.dmp

Filesize
104KB

Download
memory/1800-146-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Filesize
408KB

Download
memory/1800-147-0x0000000005D00000-0x0000000005D66000-memory.dmp

Filesize
408KB

Download
memory/1800-154-0x00000000722D0000-0x000000007231C000-memory.dmp

Filesize
304KB

Download
memory/1800-159-0x00000000078E0000-0x0000000007976000-memory.dmp

Filesize
600KB

Download
memory/1800-153-0x0000000007310000-0x0000000007342000-memory.dmp

Filesize
200KB

Download
memory/1800-152-0x0000000006350000-0x000000000636E000-memory.dmp

Filesize
120KB

Download
memory/1960-134-0x00000000053F0000-0x0000000005482000-memory.dmp

Filesize
584KB

Download
memory/1960-132-0x0000000000970000-0x0000000000A78000-memory.dmp

Filesize
1.0MB

Download
memory/1960-133-0x0000000005A80000-0x0000000006024000-memory.dmp

Filesize
5.6MB

Download
memory/1960-136-0x0000000007EB0000-0x0000000007F4C000-memory.dmp

Filesize
624KB

Download
memory/1960-135-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/2792-151-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2792-144-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2792-148-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2792-163-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads