darkcloud | dabc51f754d18831689fcc7a554459a2ca2f023b40ef126e6cd721c225a75249

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/05/2023, 06:28

Target

INVOICE098765678DCOP.exe
Size

641KB
MD5

e3351c05add94fac7045aea930fcface
SHA1

73de964b0c503e2651e80fb57ae62195bb598ff9
SHA256

dabc51f754d18831689fcc7a554459a2ca2f023b40ef126e6cd721c225a75249
SHA512

d6c77a1b0e3b16a870e0316f9ec12541e8add0dddf39edae41528a56d926cf9ae40cf1e6eaeb94a40f4b771664f0c6831187f3836a35f9ccb79aa6e0f1d206a5
SSDEEP

12288:rUHLGlTRTX4Lz/dgjzd/eLs6wNzV0v7l90RHQuk:HZKz/uP8LduWTl90m

Score

10^/10

darkcloud stealer

Family

darkcloud

Attributes

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 472	2024	INVOICE098765678DCOP.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1160	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	Powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
472	INVOICE098765678DCOP.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1160	2024	INVOICE098765678DCOP.exe	27
PID 2024 wrote to memory of 1160	2024	INVOICE098765678DCOP.exe	27
PID 2024 wrote to memory of 1160	2024	INVOICE098765678DCOP.exe	27
PID 2024 wrote to memory of 1160	2024	INVOICE098765678DCOP.exe	27
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29
PID 2024 wrote to memory of 472	2024	INVOICE098765678DCOP.exe	29

C:\Users\Admin\AppData\Local\Temp\INVOICE098765678DCOP.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE098765678DCOP.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\INVOICE098765678DCOP.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Users\Admin\AppData\Local\Temp\INVOICE098765678DCOP.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE098765678DCOP.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:472

memory/472-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/472-67-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/472-74-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/472-62-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/472-69-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/472-63-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/472-64-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/472-73-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1160-60-0x0000000002610000-0x0000000002650000-memory.dmp

Filesize
256KB

Download
memory/1160-59-0x0000000002610000-0x0000000002650000-memory.dmp

Filesize
256KB

Download
memory/2024-55-0x0000000000E70000-0x0000000000EEA000-memory.dmp

Filesize
488KB

Download
memory/2024-54-0x0000000000F20000-0x0000000000FC6000-memory.dmp

Filesize
664KB

Download
memory/2024-61-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/2024-56-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download