darkcloud | 87df770774093167df16025aa4c0a745091671d48f1113212211f4a3d79afa7a

Analysis

max time kernel
147s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2022 10:54

Target

pierwsze zamówienie nr 0015022012.exe
Size

1.6MB
MD5

71a6ab33f31b690fae0cc294301eb53f
SHA1

eb5263efbc05bd7fd135086b4ee635e49119854a
SHA256

87df770774093167df16025aa4c0a745091671d48f1113212211f4a3d79afa7a
SHA512

5c0b7aed2a51607d977dfe1b4b7883c602fb9624180a0c61f49654d794a420ba5e4fc023ab6726d2e5317f6c67e642a388abd3cb4838f4c4ddd834082986c281
SSDEEP

49152:f9fyrAY4xJKdHcr3f2JggQRZDMrTNRe0MGwOwtD:fRzJ88LKgrRo1dwnD

Score

10^/10

darkcloud stealer

Family

darkcloud

https://api.telegram.org/bot5671318275:AAGisFrFLqhVJjO72egJPifm2Q0ITZ6Nziw/sendMessage?chat_id=553496422

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3212	Caspol.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78
PID 3028 wrote to memory of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78
PID 3028 wrote to memory of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78
PID 3028 wrote to memory of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78
PID 3028 wrote to memory of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78
PID 3028 wrote to memory of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78
PID 3028 wrote to memory of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78
PID 3028 wrote to memory of 3212	3028	pierwsze zamówienie nr 0015022012.exe	78

C:\Users\Admin\AppData\Local\Temp\pierwsze zamówienie nr 0015022012.exe
"C:\Users\Admin\AppData\Local\Temp\pierwsze zamówienie nr 0015022012.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3212

memory/3028-132-0x000001EEA84A0000-0x000001EEA8638000-memory.dmp

Filesize
1.6MB

Download
memory/3028-133-0x00007FF9F3B20000-0x00007FF9F45E1000-memory.dmp

Filesize
10.8MB

Download
memory/3028-136-0x00007FF9F3B20000-0x00007FF9F45E1000-memory.dmp

Filesize
10.8MB

Download
memory/3212-134-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3212-135-0x000000000040348C-mapping.dmp

Download
memory/3212-138-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3212-141-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3212-142-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download