darkcloud | 5a592b895a2d661b84fe545722cd01c7eec0998b5c92e43cbcd582723e5d0d7b

Analysis

max time kernel
98s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2023, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.exe
Size 916KB
Sample230418-qbj4wabe55
SHA256 5a592b895a2d661b84fe545722cd01c7eec0998b5c92e43cbcd582723e5d0d7b
MD5 ecfe245fe1b78fff84ba32432734f321
SHA1 ded52a7f97da681f5f2a36392bd2ae88445fdc6e
SHA512 035a0412fff63ada8cc7ccaf37320d6a7a098ef1cb565fe8b7a30b86ff17a65f1cd1a9824b44a767a710b3242a656cb1e7ba33b134e525ccd6524e1d366d92ca
SSDEEP 24576:b+tjOIyec5mTp4uNIgU0KKlpp4m32jt49T7i:bmHplWkIT0t4kMt4t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

https://api.telegram.org/bot6267068129:AAE4AO_gQGAeEakYl26r7KthrUjdWAdy5c0/sendMessage?chat_id=1909112828

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 628	1916	PO.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	PO.exe
1916	PO.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
628	PO.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	PO.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	PO.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2692	1916	PO.exe	90
PID 1916 wrote to memory of 2692	1916	PO.exe	90
PID 1916 wrote to memory of 2692	1916	PO.exe	90
PID 1916 wrote to memory of 628	1916	PO.exe	91
PID 1916 wrote to memory of 628	1916	PO.exe	91
PID 1916 wrote to memory of 628	1916	PO.exe	91
PID 1916 wrote to memory of 628	1916	PO.exe	91
PID 1916 wrote to memory of 628	1916	PO.exe	91
PID 1916 wrote to memory of 628	1916	PO.exe	91
PID 1916 wrote to memory of 628	1916	PO.exe	91
PID 1916 wrote to memory of 628	1916	PO.exe	91

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\PO.exe
  "C:\Users\Admin\AppData\Local\Temp\PO.exe"
  2⤵
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\PO.exe
  "C:\Users\Admin\AppData\Local\Temp\PO.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-140-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/628-143-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/628-146-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/628-147-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1916-133-0x0000000000720000-0x000000000080C000-memory.dmp

Download

memory/1916-134-0x00000000057F0000-0x0000000005D94000-memory.dmp

Download

memory/1916-135-0x0000000005240000-0x00000000052D2000-memory.dmp

Download

memory/1916-136-0x0000000005140000-0x0000000005150000-memory.dmp

Download

memory/1916-137-0x00000000051E0000-0x00000000051EA000-memory.dmp

Download

memory/1916-138-0x0000000005140000-0x0000000005150000-memory.dmp

Download

memory/1916-139-0x0000000006650000-0x00000000066EC000-memory.dmp

Download