darkcloud | 37203c38c11b529b8d10382dfb610e739ceb38daae8bc1c19f28506edf3dfdd1

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2023, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
金璽CCIC 0408 inv 4-18.exe
Size 1.3MB
Sample230418-ff9j8abd4y
SHA256 37203c38c11b529b8d10382dfb610e739ceb38daae8bc1c19f28506edf3dfdd1
MD5 dc95bfefb5e26c55ff5efed30c817515
SHA1 4ca5ce802af1d29dcd1c4f1cf4428cb20d111925
SHA512 b4e9bc5b7f511dc30443f327ccf427ce1d342fd4e31d3cefec4d22e8bc356a3e971c1b678c18c3d07198df3ea22f184addb52dd4a1dd5e7b0f360fc3e1972ec3
SSDEEP 24576:DTbBv5rUDwcywjLAXjXXRQFX8KZtB34NPPFDXpUUBQjqfYTfz7V2EggiVEH:dB1cLjUtQSo4N3PUUZ8V2Egm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud persistence stealer

Malware Config

Extracted

Family

darkcloud

Attributes

email_from
[email protected]
email_to
[email protected]

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	金璽CCIC 0408 inv 4-18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 3 IoCs

pid	Process
3332	bdxqep.pif
1836	RegSvcs.exe
1512	RegSvcs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	bdxqep.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rnxu\\bdxqep.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\rnxu\\idnhddr.dll"	bdxqep.pif

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3332 set thread context of 1836	3332	bdxqep.pif	96
PID 3332 set thread context of 1512	3332	bdxqep.pif	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1836	RegSvcs.exe
1512	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 228	4648	金璽CCIC 0408 inv 4-18.exe	87
PID 4648 wrote to memory of 228	4648	金璽CCIC 0408 inv 4-18.exe	87
PID 4648 wrote to memory of 228	4648	金璽CCIC 0408 inv 4-18.exe	87
PID 228 wrote to memory of 3332	228	wscript.exe	93
PID 228 wrote to memory of 3332	228	wscript.exe	93
PID 228 wrote to memory of 3332	228	wscript.exe	93
PID 3332 wrote to memory of 1512	3332	bdxqep.pif	95
PID 3332 wrote to memory of 1512	3332	bdxqep.pif	95
PID 3332 wrote to memory of 1512	3332	bdxqep.pif	95
PID 3332 wrote to memory of 1836	3332	bdxqep.pif	96
PID 3332 wrote to memory of 1836	3332	bdxqep.pif	96
PID 3332 wrote to memory of 1836	3332	bdxqep.pif	96
PID 3332 wrote to memory of 1836	3332	bdxqep.pif	96
PID 3332 wrote to memory of 1836	3332	bdxqep.pif	96
PID 3332 wrote to memory of 1836	3332	bdxqep.pif	96
PID 3332 wrote to memory of 1836	3332	bdxqep.pif	96
PID 3332 wrote to memory of 1836	3332	bdxqep.pif	96
PID 3332 wrote to memory of 1512	3332	bdxqep.pif	95
PID 3332 wrote to memory of 1512	3332	bdxqep.pif	95

C:\Users\Admin\AppData\Local\Temp\金璽CCIC 0408 inv 4-18.exe
"C:\Users\Admin\AppData\Local\Temp\金璽CCIC 0408 inv 4-18.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" Update-hi.l.vbe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Users\Admin\AppData\Local\Temp\rnxu\bdxqep.pif
    "C:\Users\Admin\AppData\Local\Temp\rnxu\bdxqep.pif" idnhddr.dll
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

bdxqep.pif

Path C:\Users\Admin\AppData\Local\Temp\rnxu\bdxqep.pif
Size 1.1MB
SHA256 fe8f3a792755b769d1db127e5cf0cae81d22d2bec99c5f789ab346b5674cb238
MD5 3eb953cd09e2c1caa817aa6b7f6aba43
SHA1 1483df9a519b12eee38dda4a5ce599f0031f6bde
SHA512 3f8330fc6341c78b3843f256037c829964cc00e8eab761f02e66dc3abfd463aae6c09bc4b0cd51f7c5a738f69c309786adc14351b286c36dc7be858c15b29b62
SSDEEP 24576:aYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCjsUYYYYYYYYYYYRYYYYYYYYYYpDP:a37+KSbq5e1diEnHaCjvYYYYYYYYYYYX
MD5 SHA1 SHA512 SSDEEP

Submit Download

bdxqep.pif

Path C:\Users\Admin\AppData\Local\Temp\rnxu\bdxqep.pif
Size 1.1MB
SHA256 fe8f3a792755b769d1db127e5cf0cae81d22d2bec99c5f789ab346b5674cb238
MD5 3eb953cd09e2c1caa817aa6b7f6aba43
SHA1 1483df9a519b12eee38dda4a5ce599f0031f6bde
SHA512 3f8330fc6341c78b3843f256037c829964cc00e8eab761f02e66dc3abfd463aae6c09bc4b0cd51f7c5a738f69c309786adc14351b286c36dc7be858c15b29b62
SSDEEP 24576:aYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCjsUYYYYYYYYYYYRYYYYYYYYYYpDP:a37+KSbq5e1diEnHaCjvYYYYYYYYYYYX
MD5 SHA1 SHA512 SSDEEP

Submit Download

idnhddr.dll

Path C:\Users\Admin\AppData\Local\Temp\rnxu\idnhddr.dll
Size 103.4MB
SHA256 6325c158188ea3be7b1137885ca6b191d6391df0d0ac2dcb2d77f5ee846aa644
MD5 8a9e60214a7b2ae0e446e9691836d67d
SHA1 873eecd214bb3300a649b198c1c17e4e3054a36f
SHA512 4db3ce1043c7bfb8c959ffda05b4d5aa06c78915d8f200ff23312ffa0c3a4e5aaf2b32ac09a3422a703e46573308c9b600624ecb25ab6ea401efe81caa10485c
SSDEEP 393216:H+ZXxISGNXEjZMoymVuHouai7p7uauZqhTEsKUXI2ErwcxFKpdnd5dTXg0WP1+DN:V
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixdxkvic.dds

Path C:\Users\Admin\AppData\Local\Temp\rnxu\ixdxkvic.dds
Size 710KB
SHA256 79958339e5bc02f83b8503ee985901e10697cb7d69b5257c24c90576f7311e93
MD5 eaead7d8d4ba97c305489a6ddbd159b2
SHA1 0fba620f34155f5b713bc9f100ac645689a6597a
SHA512 1c7f5ec4e7336a6cec7c765ed6c7ec903f9cef28bd961ea269b11ec9a53311f438f0f8a25cfec7ecc62049914b9cf7f50b95ef42d2bb8265583201d304952190
SSDEEP 6144:a0Y0xcJ1+dsc2CObQfXsSxET/12nlXRFemabp3A5Osd2MzH4ZiRfhJ0BPJGCMwqX:k0xrtSSkPl6NxUs3v8ec5jyeG4jI
MD5 SHA1 SHA512 SSDEEP

Submit Download

srrd.dll

Path C:\Users\Admin\AppData\Local\Temp\rnxu\srrd.dll
Size 40KB
SHA256 8e227800fd4d2fad597896cea7222aa569b3b580097b5e35ddfb85809b70a134
MD5 fb2fa54d8fcbae766cb036fbdda5a0a5
SHA1 26f1608211a4586df679f7522b25e954f8913e1a
SHA512 a7052b244b4a7fd147f3a32117825f71aa8fe98b220517eb0f669f37a08b3074adeb22d672869cb21d89f279be88a482c429a568752fc4e9d8b2ab3832114125
SSDEEP 768:7ESaFYTs74TFZHFR0N4H/xhCY28o+3I7FZ6QV2pm1Gx06sy2sW8pMqCYtQA:DPTY4pZH8N4H5to+30Z6lgAx060sW8T9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Update-hi.l.vbe

Path C:\Users\Admin\AppData\Local\temp\rnxu\Update-hi.l.vbe
Size 60KB
SHA256 796c94b4836f217fda661eec429dc915c12fbca6b7d0a3bbf9550fe95e29c555
MD5 5fad802115f2749550820cda2ad58bac
SHA1 34b47e0d094908ee4eaaacbddca60ba33e05809c
SHA512 3e018ad8a397ad93448ccdfb76222fd2b40f85a6ef329a17dfcc7869b7df8568d14110a41d03ade7c322ff8d98408c78d17698a224fb421f60b4aa1745bbf468
SSDEEP 768:A1C1SQ41C1SQ11C1SQO1C1SQS1C1SQA1C1SQB1C1SQD1C1SQE1C1SQr1C1SQv1CS:AK4K1KOKSKAKBKDKEKrKvKUKZK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1512-201-0x0000000000400000-0x0000000000ABE000-memory.dmp

Download

memory/1512-205-0x0000000000400000-0x0000000000ABE000-memory.dmp

Download

memory/1512-211-0x0000000000400000-0x0000000000ABE000-memory.dmp

Download

memory/1836-198-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1836-202-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1836-210-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads