darkcloud | 87df770774093167df16025aa4c0a745091671d48f1113212211f4a3d79afa7a

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/12/2022, 10:54

Target

pierwsze zamówienie nr 0015022012.exe
Size

1.6MB
MD5

71a6ab33f31b690fae0cc294301eb53f
SHA1

eb5263efbc05bd7fd135086b4ee635e49119854a
SHA256

87df770774093167df16025aa4c0a745091671d48f1113212211f4a3d79afa7a
SHA512

5c0b7aed2a51607d977dfe1b4b7883c602fb9624180a0c61f49654d794a420ba5e4fc023ab6726d2e5317f6c67e642a388abd3cb4838f4c4ddd834082986c281
SSDEEP

49152:f9fyrAY4xJKdHcr3f2JggQRZDMrTNRe0MGwOwtD:fRzJ88LKgrRo1dwnD

Score

10^/10

darkcloud stealer

Family

darkcloud

https://api.telegram.org/bot5671318275:AAGisFrFLqhVJjO72egJPifm2Q0ITZ6Nziw/sendMessage?chat_id=553496422

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 828 set thread context of 280	828	pierwsze zamówienie nr 0015022012.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
280	Caspol.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28
PID 828 wrote to memory of 280	828	pierwsze zamówienie nr 0015022012.exe	28

C:\Users\Admin\AppData\Local\Temp\pierwsze zamówienie nr 0015022012.exe
"C:\Users\Admin\AppData\Local\Temp\pierwsze zamówienie nr 0015022012.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:280

memory/280-56-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/280-57-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/280-59-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/280-62-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/280-65-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/280-68-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/280-69-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/828-54-0x00000000011E0000-0x0000000001378000-memory.dmp

Filesize
1.6MB

Download
memory/828-55-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download