darkcloud | 2602293f954bbbcf9d3d6000c3bd7cc76cec8b29ae9aca6261afe4a3ba7bfe19

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
556dcd0eedaf4d90e6d14f07362a4b3e.exe
Size 1.1MB
Sample230505-ppg11aae22
SHA256 2602293f954bbbcf9d3d6000c3bd7cc76cec8b29ae9aca6261afe4a3ba7bfe19
MD5 556dcd0eedaf4d90e6d14f07362a4b3e
SHA1 37fa4e1b1e7955d52e0580850c3898c71a18726d
SHA512 882916f5c4b96a3aa5cd780efd9f92dcfc34ec68e0eae52015d630ab22156128f3f6b952466152c9f5ad6c8d4daef7686217512a7ebec26cc5b94e41233f2b32
SSDEEP 24576:ePKA0WAil0koMFyALUQ8CUyxxDRJ5q3P4:KqWrl/oM5hRbq3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

https://api.telegram.org/bot5910132523:AAEKRc8fOn4WgyrXgHzd8WfRx78_lEgkCaI/sendMessage?chat_id=5877439820

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1000 set thread context of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe
1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3900	556dcd0eedaf4d90e6d14f07362a4b3e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3900	556dcd0eedaf4d90e6d14f07362a4b3e.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 3804	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	89
PID 1000 wrote to memory of 3804	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	89
PID 1000 wrote to memory of 3804	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	89
PID 1000 wrote to memory of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90
PID 1000 wrote to memory of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90
PID 1000 wrote to memory of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90
PID 1000 wrote to memory of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90
PID 1000 wrote to memory of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90
PID 1000 wrote to memory of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90
PID 1000 wrote to memory of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90
PID 1000 wrote to memory of 3900	1000	556dcd0eedaf4d90e6d14f07362a4b3e.exe	90

C:\Users\Admin\AppData\Local\Temp\556dcd0eedaf4d90e6d14f07362a4b3e.exe
"C:\Users\Admin\AppData\Local\Temp\556dcd0eedaf4d90e6d14f07362a4b3e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\556dcd0eedaf4d90e6d14f07362a4b3e.exe
  "C:\Users\Admin\AppData\Local\Temp\556dcd0eedaf4d90e6d14f07362a4b3e.exe"
  2⤵
  PID:3804
- C:\Users\Admin\AppData\Local\Temp\556dcd0eedaf4d90e6d14f07362a4b3e.exe
  "C:\Users\Admin\AppData\Local\Temp\556dcd0eedaf4d90e6d14f07362a4b3e.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-133-0x00000000000A0000-0x00000000001C6000-memory.dmp

Download

memory/1000-134-0x0000000005030000-0x00000000055D4000-memory.dmp

Download

memory/1000-135-0x0000000004B80000-0x0000000004C12000-memory.dmp

Download

memory/1000-136-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Download

memory/1000-137-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Download

memory/1000-138-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Download

memory/1000-139-0x0000000008120000-0x00000000081BC000-memory.dmp

Download

memory/3900-140-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/3900-143-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/3900-146-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/3900-147-0x0000000000400000-0x0000000000490000-memory.dmp

Download