darkcloud | 0113aeb6aaebe1d0bf883dd7722ac71903050fdbfb17c4f9a59aa60454c869a8

Analysis

max time kernel
59s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16/01/2023, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10690531.EXE.exe
Size 1.0MB
Sample230116-t39emadh2x
SHA256 0113aeb6aaebe1d0bf883dd7722ac71903050fdbfb17c4f9a59aa60454c869a8
MD5 0a8a30056153a9a32e3b5108a859ba5e
SHA1 3d17976ee0293543d36d6e6add71ffcb0df858ce
SHA512 826713962b6cebfdfc3f4096f831286ef02725052fc8fbbcac9ef8f82f0e532faf44be6baad9469e233f5db7e58627ae3be91eb0104a8b1a2c7670052256b357
SSDEEP 24576:RlgtS4JnMTcjpp4+W1ujgrG5ONqnsNbdcRbgPD:0tS4hMTcr4swGsNqnsJyhgPD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

https://api.telegram.org/bot5600570226:AAHJb0fknFizxQmiF8ZZa9PUFzEkjz5HB4A/sendMessage?chat_id=5975717790

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 628	1708	10690531.EXE.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	10690531.EXE.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	10690531.EXE.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	10690531.EXE.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 540	1708	10690531.EXE.exe	28
PID 1708 wrote to memory of 540	1708	10690531.EXE.exe	28
PID 1708 wrote to memory of 540	1708	10690531.EXE.exe	28
PID 1708 wrote to memory of 540	1708	10690531.EXE.exe	28
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29
PID 1708 wrote to memory of 628	1708	10690531.EXE.exe	29

C:\Users\Admin\AppData\Local\Temp\10690531.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\10690531.EXE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\10690531.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\10690531.EXE.exe"
  2⤵
  PID:540
- C:\Users\Admin\AppData\Local\Temp\10690531.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\10690531.EXE.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-66-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/628-73-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/628-61-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/628-69-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/628-60-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/628-63-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/628-72-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/1708-55-0x0000000075551000-0x0000000075553000-memory.dmp

Download

memory/1708-54-0x0000000000FF0000-0x0000000001102000-memory.dmp

Download

memory/1708-59-0x0000000005E10000-0x0000000005E8A000-memory.dmp

Download

memory/1708-58-0x0000000007E40000-0x0000000007EF0000-memory.dmp

Download

memory/1708-57-0x00000000006B0000-0x00000000006BA000-memory.dmp

Download

memory/1708-56-0x0000000000460000-0x0000000000476000-memory.dmp

Download