Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 20:55
General
-
Target
PurchaseOrder202319876.exe
-
Size
1.5MB
-
MD5
9b2f59561115406e4be61403a0add295
-
SHA1
3068c0d984638b73a75f568cb49557543c344b59
-
SHA256
9644c370f8d029005b9ab653ab47487d24fcd626abb3f34157e2fe31e617edc4
-
SHA512
47f9b8352c0f75decbdd3734ae1916cdcd1720406b442f5210166e703585b12edafad569a7f687c8c66741aa786a6319e382aa95c83580ced345768dbd3ab939
-
SSDEEP
24576:jQ3UElRshsEyPyG7cYYKLTl8+oyVryispex6Cn1rwUMpuPpowgbeazV32JNBJOmB:s3UElq6EyPF6KLJlBxscfrwVuPpyzmh/
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046
Signatures
-
DarkCloud
An information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PurchaseOrder202319876.exe"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder202319876.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PurchaseOrder202319876.exe"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder202319876.exe"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5d724e4367df183c230f9be681577611b
SHA1952df21862bda1de5c0915ac9dd537d55ed96cb0
SHA256007e5c35a20ae332cf93ea88c6b8ba813c47533718c1cd6d2113e9995c2ff13e
SHA51208878ad3d4296c8f7dc2a8f2a3b51abaadf2e7d7c696a21740af4d8d2c45100d91dc612562760c909dc3e74c9b7a693f3b1704fd1ad06c11878632f0a5746b1f
-
Filesize
1.4MB
MD57522b4c893e17e1e3a0b188a83cab6f8
SHA1ddca1c5fba5549d77fdd30a05fd53e0a8e7391d6
SHA256802db481a25b8ac2f9c1c66e9d8f210bc58c4a9f2ca55e26bdfa660bb4e31de4
SHA5129705431647297faa5ab4687e4239e3e339f30c77385e0b2c7b4d937ca114c8a61a4fa73bb4fa738d66a428fae599a99b28467d9f88de18c209dded31d8fc4b47
-
Filesize
1.5MB
MD509b4440521d8aa73ea4dfc0a4ea4feaf
SHA1918884df552bf8e03f60ec2aa48e9b70466b55f7
SHA2561407556f314940a9857ae5a01fd8fbed01d8161532a1db2dbc76fe1bedf7ac3b
SHA512cb234c9c0636e42006c24b372c602ad98a5d887e8c969cfdde1feaed30cc05c71fa2286a6806313e4e22dd9bcc538f03c0d906f0583404c1822d851b505040d9
-
Filesize
2.1MB
MD57fa663a9486b337e2a437a35235afa07
SHA14e9a12d92f1ddec334bf0f803b54ba8fb735d007
SHA256fbb74b084fc4518c005bc2c0c379f8f29f8d9b2dcbfb34ea12f1d89ed0a75f81
SHA512900e81ab4d12d4f5071a6c178e86a04a71b6766a59092aad871e5a617fa09ea3cea18fd52d491515f2e7f53ee83a366a36161855801cdfc1fd651834e4a31d90
-
Filesize
1.2MB
MD5d8c15a538b8a5b57d561664151b441f9
SHA19ade62aa1dff2e5db61a1146ac4c4b42ab8b1dc4
SHA256cf27a97fbf2b41af76578dd1278df45ed5b1480b953501f31c548f2b50b84ae3
SHA51226702d8077797762ed2f95cdb3e2e471de1bcf8ea1f49a8f5cc16d4637bd4310b6ab0c3c7151ae5f9bd5e6de9851780f22c76159e8f2247e3943614a2dbbac1b
-
Filesize
1.7MB
MD5ce9bf31d22ba7545ff55c5a13e9e03a9
SHA185445bef0c7587bedddbccff0561e29ab74bc969
SHA256d934e6a134b329867f6869cb9de7da965d706e3fc323cd3655b0dc928183219e
SHA512f2b15330846adf8fb5ee2602f0364278ef8964f623ff509c6b085be726df39a56ea99bb0b2b8ace1aedfc97a845fc6832546a95592d9fe2f92d8c6936f4c70d6
-
Filesize
1.3MB
MD5b95c72985a765a842c1d6cbe4c77926e
SHA1562f8f32015c2f7a5f61feaf53f14ab8c665ab6b
SHA2565b234a9cc3907f24c440be8fb418511fdfa645168e3dcfa64b46a4416ec5e998
SHA512da7cad8ef59a5a94d1e437f0af3f5de216c2de96c885f9221b5ab10a1f853d35f35f8b4ac6319c7af1372b0bb99d9e38dc7156007c4e519ed93eecdb075ff06c
-
Filesize
1.2MB
MD54d3e3b3719dbcaa3e92adb142a5c03b2
SHA1208df553558bdebd25f033e8a5f01ff058f9bb8e
SHA25653f51a9a1703aff9270de857ca541b1b6acab3d2a9d7a4832d3b0bf48dc7c72e
SHA512b2717f7f24624d79875c3ca51c44add65b5143cce168fb890e13087e8365b69d345ece9557601fa69f2f99259ce0fd1d977f0e7ed4a020ac9ac36d7a8acf4604
-
Filesize
1.2MB
MD5e7f844fcd78c58e90ef6d4bbedd954b3
SHA165b665cc9608cfd4eb03af85cefb581c099d9058
SHA25609ba93db1d4cfe9762464b09274d0d8b082ff268c1ecd1c299c15b6863f7e31b
SHA5124779a04f33e6b3a8b431cd1c672ef60c0d5a8b343dd175db11b623f9f456d2bed3ccaa3c5cbf3d00d1fd1b1a8b5ff8b4ad4442314a7ce6aaa0b21527466b5ed6
-
Filesize
1.6MB
MD5108b45d611988c76119f3e4f7472f5ad
SHA1a7b1d8e57de535718d74bf14f0acd20e03fb74b5
SHA256e2037551416b74714462f708201cdb2b63658e59123401f688b4c0a1b1318c1c
SHA5128a7482d977b96889a7377af3a881856f8f2a2fde30567526938ae974f293e2d959504111cc5db6bd9107154b2b5cc8cac777a7c497bb0de7699783032db988ac
-
Filesize
1.6MB
MD5108b45d611988c76119f3e4f7472f5ad
SHA1a7b1d8e57de535718d74bf14f0acd20e03fb74b5
SHA256e2037551416b74714462f708201cdb2b63658e59123401f688b4c0a1b1318c1c
SHA5128a7482d977b96889a7377af3a881856f8f2a2fde30567526938ae974f293e2d959504111cc5db6bd9107154b2b5cc8cac777a7c497bb0de7699783032db988ac
-
Filesize
1.3MB
MD5ebed1108dd24df2f0c97e5dc6c3556f8
SHA1e2033fa75a96d86dfff3dcd803e38378c68c13f0
SHA256802868dc666c00dbbe924f366669e3e4ce1cb96327fe2dbf8ef3d71922cf097b
SHA51274bbf3244e5da4d6a9f9897443f02fde372b0553ced3423548b777432cb0cab55cb3631639a65ada102021e6d99fe80c517692f30c82c64f2b7b75c0bfc7a852
-
Filesize
1.4MB
MD55ccd5ac8671b5e872aa5f188ef1e502e
SHA18e9afed86270c86425f36f9082954cfb209100da
SHA256364bec6e03b173bd8fa106ac7f972bc513c3c24e608ec39db21eaee1bd59a3d1
SHA512e4b4340f7934782b498c5db9bd698a90147c282ad184c124c09f5ded7c8cc11c01a715b3428c6d448c0927d1be03d439ef63fe1bbf7e00f2095238ac86f79711
-
Filesize
1.8MB
MD5c04d2f85e341b9027ffbbfbb160831b8
SHA1baa71e30f9d730d72319690e3f9f327b34f15f7c
SHA2568ccaecc2cba04f7aae7208381323b0be3faa33fded05bbd2d1ace934f3ea3bfa
SHA5123c87d52fa3d4647197babf022ed26633fadf498639ebb0164f05f4dcdb14b7016823f0197dffa602d04757890def12cb81409b2a0fe4eaa1dc7426b7337b582c
-
Filesize
1.4MB
MD5b6aa2cf58ac87cf84c0209a7d46dfb16
SHA1d4a875870c1b15ad0594629d25fdf05882d14ae3
SHA256df794505ef3ba6fbf4a4f3520130379cd8e0089c2a4bc4ec8c694acf12e0d11d
SHA512e12ef12a8577127408623442a15a28bf787a69afd2df24aef2c8d5e8b3f5229a09a89a211e1c663080654ab7937c468e9a01fc454aa570207869db07cfbdfaa2
-
Filesize
1.5MB
MD56ea27e5ba43e0cf4dd1c0e5bef1e5f31
SHA1ab54bb3a50b06cdf52fc58aaab0244c0a384bdbc
SHA256025b78b75ac033f6a6c87b16992390ba48ba7737ba303c245ecaceef5094ddad
SHA5121b365ffecc613fa70f94106eff6d942edaafae714cd5d32e72150895dbc8aeeb92122dc4e2a11ee1ae86432cb783b3c3ea04d9f3752c90b6076f98f5a2fc0455
-
Filesize
2.0MB
MD5f8bcfaa2c7e8711af01eb4d26a9fa533
SHA136317d3ae9b63a46a0d4177e1f30976363a9ae67
SHA256223c2118d4e4e4ab216506fb78cd1fb6c84bd957e0d4a837542a75e61a1bb79d
SHA51207623a0ecc0528db9c856c04d5d771c7ad82ee413cc07c8db2f24296c464a3afacb84cacf4adb8919f1b1601fccb0fafbadc20ed340695c7d666a6fdb89a5001
-
Filesize
1.3MB
MD54e9ea5a683860ac43d3edb56ac3b20fa
SHA1c51b4159a7d2bfb082a9316e88a1df7aac721235
SHA256458efbdbbcd85ea56b5eb349bc5ca1eafe763e3dccff8fb46b120629c81ce55c
SHA5126ec5b24721fe553381fbafbc514d9a622d9a6ea268f793f0f0e36cc8b8c07bb18f449030a1856d0afcf183d4630518ced7d23ceb6001ebd3515ecbada5ccdc56
-
Filesize
1.4MB
MD53998b0e33052aeeb4ee4a48712865f37
SHA10ac4e836d51668236709fcfbb009e1d2cad8a7b5
SHA2565387f11a778b84831630e5d8748d95b06fdb243d21e17fac9038ad8da878f3ac
SHA512e4607a450381b6b135aff174efd066517189460e92eff9bbb6aa1b5b1ae7952143ef3a91d7946a317c1256f2b630ac8290a7327a277330bd7be30b35beb257f8
-
Filesize
1.2MB
MD5016fff2044734e2de516c10d1c44a042
SHA1d622b3fcef3310dd24fbe3952ae8b2848674711d
SHA25629bdcd13d62056783fd7a3f369a8c432a3aaf3cf1f6f01b56f0e8f85de090a6a
SHA51299b66e87ba81d1a82e25484fb5a64602ed7b7449e8e84ef0599c432ec66da48314c1b644170fbe1005398d81b78efb309c897a04871f8df208f08b582bb10529
-
Filesize
1.3MB
MD53d62c6b5fb242ba04c4ebb514c758bf9
SHA10fa59de88d44daec39f7bc6846489ce8fed117b4
SHA2567240c6e510b67cd0c5073ec4f3ed87e4256c86adf7f313fcdf8d2a1ce6dc84fa
SHA5120b708a7f1fcdd3b694c80cdb29b6c65f0af60ea88d88083d4789d53e1f317d357256b639acad3fbddb9e861dd41d515e1027624eeb2a01f75613184d37f1e56b
-
Filesize
1.4MB
MD505430150e088b7525b00abe566ad4f71
SHA1dde9b458d8f5a60c273f9a4a4eb2befe73691cf0
SHA2564ca8b1f95fd1e177132dc6e30dbfe7c5147e5b1151ab8a6fe3046308232b967d
SHA5122c040faf09a7e962dde7ac958862c7d3e7c85a50f93a370f8bc5fc4211e52833ebf14314851e4a3f9ab223611db6bcd82d989161c8ed0060daa4fa1b488563d4
-
Filesize
2.1MB
MD545d1f362611bcf004405507b7bd477df
SHA11b90e4abaa1e532a55702b1384bb85138b597658
SHA256fdeb3969c4ed4c6cc9f51389a93343b1413de36a9113fb68628685334522d77b
SHA512e47ad3036f652fa0edd06d9574be2300a8353a5e73976e7d7ae78ed5a5a78980d186d4b08ad0dc1d8261768b7cee488ce78d6021e564752d27831931c0d5d602
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
292KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB