Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
10/05/2023, 11:36
General
-
Target
SecuriteInfo.com.Variant.Lazy.338484.17766.6491.exe
-
Size
1.6MB
-
MD5
26267aefb12de3eface8ae87dd5d4a6d
-
SHA1
88aad0f963f04e283183f6fe02db0b9c384f2df4
-
SHA256
847e04095e646bc56458e498de0e8741d873b777567a0372b59d27d4f1d3b625
-
SHA512
38cfec123689aeb8fa3a628f5a99132686b171871e799790b1e9a891710b1cf53f518f523baa67bf5bac527e2370ec759957bbe23cbbcb555098be687406c833
-
SSDEEP
24576:lALd9G4jLamVOjHuCB3G2Z9+HCr7YJ/38yT/BFqHac0J10307SGMjo:S7GsGgOLnB3j/+c8PFTpgHP6ahG
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046
Signatures
-
DarkCloud
An information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.338484.17766.6491.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.338484.17766.6491.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.338484.17766.6491.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.338484.17766.6491.exe"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5752d092941555c645b7ac500cdea4b07
SHA1b6f7a82b674bfc3115273b47e09c118e07af6821
SHA256c292c7563106a60ad047fc1af66968b513dc932c00d866f61cc90bb6fa08f4c8
SHA512b828c00ffa23ab2aaf3864e607565641445b4e181b74e919cd4e9f0de2c73540ea06670ab6982157a6b95455c943ce3d8ac12da9032a619b8ee8aba89f50e8fc
-
Filesize
1.4MB
MD52b4f2672da70d3296f7f7ae5a8bc36de
SHA192c408034a4d5e05585ceb0e877f7772969109f5
SHA2568ad9c92ad58f5febaf6ce78dc0f6fa63b29aa6173675c6b2a15fe2279f4a4c26
SHA51206ff036d0b462de02761abe84371903a43589c4c8aab8310ed5a6bd0caabd8e8c8d68ba1860ffbd045c6d3179e56e6328179dc455c7d35e080f360449d56e43e
-
Filesize
1.5MB
MD519c6384624ecfa103332a1510137649b
SHA1334af6a5f149b08ba9c6d27953358f41dadd260e
SHA256c3434902a054328d59232df89713d4f3fd0b6dbb261760f526f4ff1148dd74ef
SHA5126b34f4da3c86bde91df955d1b2df8f4dfcbd50e76f0000df106847619ac73be15e20e1c0babf784ca90cbd2597259c0ac94a7d45583f8a7a16eefaf10784581a
-
Filesize
2.1MB
MD5a3b4337fb052a6bcf6865deacd087aef
SHA191419405259e9a3608bf84c8b2f29989bf52ddfa
SHA256fa3f35f0d5dbda5907210c5f4fde11ff2e7ccefdf774d3485a9da564cf1cc4c7
SHA512a4868a55861be1df4ab5095eeb3ac702eeeafd15417696f977cf171c58b42f52a347d646261f07b59961c110f3a2b756474a8aac4d89ca9155950fb56a79bd3e
-
Filesize
1.2MB
MD53c3dcb2ed6df9bd1fed5bf4161cacb24
SHA1bf5f994cc401f145ce0fd95626f94a45f636eaa0
SHA2566ba18e923450d492c4fbb25a0663a9d66cda662744bdc6419e1741a0544f39b5
SHA5128345cbf0dec655de08a1089a3f2ffd2266fd6008342174732a75fdc96c45cb2398aa7b8989de30a5abe834918a0cd87b0ec577d71627057783c5cbd6f7f91c2b
-
Filesize
1.7MB
MD57a14cfc5f60148120800845338f1fb32
SHA15c325697f04bbdce0af0b5b6afccfbad9d36b1b1
SHA2560fd117c17f45321fb6fa4a256131ff4ec1a558dee52f0d7d8a0a9d868e4d502d
SHA51223c5fb33bc5dd91b3de048f019cf1178050c0ac748789bb4b98085848aee72e96e46e9899b3aee0d5b8c1bf1b7dc3b935660eb35b0555794769b917e11b5f9ae
-
Filesize
1.3MB
MD513f744cf5cb20778a36043977c32fc96
SHA175cba4269f1fe22cee84526afa403a9147639c98
SHA256103a9de9d801c39646ab8de67e3c51f88ad90b67fbae7fcfad4cbfe5e3953589
SHA51293252d03988ff32b6b1eef6e3ae3b5c35f8a2e15cc3e9a9463cc76ecac70a8c42ba207c93b067faecb6b7403a01a6acd1b5f6902ccd5c9b081bf1fd3ea703435
-
Filesize
1.2MB
MD50ec898b89b8f6232dda061c1573f931f
SHA18fb48920f0dffbff27e4c5cd067bbbb500962f59
SHA256525086df2412fb664356778cd53859e55d9867550d5a41b1b8e06e21cc6bae04
SHA512fdd6283165f8d52c4bdd6fcbbd12e0c0e25a832467c2d6f1d2883ace572a830e238708e5fafcd39e2c76649b2d481a1e8f9997f2659d4815a65abcabf7e38306
-
Filesize
1.2MB
MD596d6c3db3f9aad920c661792d398c7c6
SHA17efa11af272329d9d6651fe96950d628f3a7986f
SHA256ded70f97e4f9e80bd0f615fcbacc61742a9cdfd88d1880734521f25c195bd6de
SHA512cb37dfd763b0cc269b0aba723a55443fad024897a18eed284377893a2e7c612270069aa9d6dcad6366dd3b4c57878482f9734257e39e8b1088bc1660fbf510da
-
Filesize
1.6MB
MD5269dac50c1645a37018c04968b6a6f19
SHA171b5e169f29a001382ef419472d39d320030ff62
SHA256b7f78a9c2c5dbc5de7f3ec286624b544b76f8e038a906d160dfafd10bcc9f381
SHA5126118c5a06926c46df015fd3402be971a8e220a18f7ccbfcd72d266385c11a87404bd130608ea4287dccce768f1eebf1e429668227c14e2a48c1de583c3fef459
-
Filesize
1.6MB
MD5269dac50c1645a37018c04968b6a6f19
SHA171b5e169f29a001382ef419472d39d320030ff62
SHA256b7f78a9c2c5dbc5de7f3ec286624b544b76f8e038a906d160dfafd10bcc9f381
SHA5126118c5a06926c46df015fd3402be971a8e220a18f7ccbfcd72d266385c11a87404bd130608ea4287dccce768f1eebf1e429668227c14e2a48c1de583c3fef459
-
Filesize
1.3MB
MD5b7b335465eb2665a6dd90cd28dd61944
SHA1908c41f2733ffd9e191ab298fcb73079359baeee
SHA256e6dab8901b6cf945b3b027540f9c8079755b715e2401286602c7e1f23472af99
SHA5129bee10f566f84bbef3c31bac54c3ce9ba8b8960069a4293272f859624fb924d4aa1bfe63ef02bf4908d79a2d82c7f39f40f9fac09641ca3a5a1658e00bc857c4
-
Filesize
1.4MB
MD57d0c9f0160bd7419bfbe87fb2fd4e2cd
SHA151380e85d695e2a5232615548d76ab496d99e9d2
SHA2564ab39b185e7e96baf94feefcd72ec885a4b4250bcfe4dcae2c747b992d64ecef
SHA51219397dd9da81380515469371660035b6499fbd99b278b17e4e642bc623594b22b613ef87684c329bb7bc45ee4237aad0dd38d7c191dfeef014d9b005a335844b
-
Filesize
1.8MB
MD59046a9933def6a8f75ba4db4bedbb539
SHA1325bf1f6f3ccbb14bad1ba039f696c565e5a8d3b
SHA2567218bca8c1ef2e9930ba2b989392e4fc3223e5f7e0cec58ce27f229233074d1e
SHA51220d90f58993a6cfbb23ef019796b020385c9c1ee87b65892c066fdd08fd61f4f40b3616b916065d22c4901b0ea168951083f7656033f36413c2e5e5d976fee51
-
Filesize
1.4MB
MD5869b4bd2b62d0662f09a11c77eb9c660
SHA115b607cec8d44a3834d4d856d7700f33f019f41f
SHA256df9338a977c16ecf9a473b54ae7487376c2cca2c43d74e1754588edbbb268e82
SHA512711bdf0eca98388a7f2ac76520330c0105f1a1f874329946dc77c6c80343339748a13113b89b66b2cc01a6584feab220392b4219ee0e164c0ff44cb7283372bf
-
Filesize
1.5MB
MD55db28a29a609f91f4e52cd5da8157559
SHA14e4488e60bf3231db90f3da6eef0574631391e75
SHA2562d1128fd728b281bb4881d22ca0186d0f9c11a9c33fcb38264b4cc3796fa3e50
SHA512d94337297a5b635a5d7874651423ca557e03aa7bf22e8ca5656379f79f3ee6b38fb4b03e6d54f31aff26754762ba31e6614197e42cad69ce1608f58d7621cdc6
-
Filesize
2.0MB
MD5f38cd9fe91c6b4cb43786fd631ea4ac0
SHA1f5ad3f0e59dcd3f3a903c5e2d7f4314fce681869
SHA256c4afdeeddd868d97703a01424bd92af396803c3b6aca774f6c7a675619780b2c
SHA512c623524b9a85c24a557d570b45ffb0dca509d6e329fa95fea9fbbae6b84ab501b17a9fdffc3c54b7deb0d2ad48c0d781ebaf1b8fc5f3b12e67ee84238a042080
-
Filesize
1.3MB
MD52e1c821ff445c99bc688bcb455ff606b
SHA1862c89d0eb658f2b9d6d1e45eeeeb8a6522a2a15
SHA25693719c242f09e69d70787c9563df37ba3c089474eae601cb218770dfd6f30346
SHA512b395b433d09e3e57cc7aa0c8e4badcfa574264e15e89b3041ee34407d403b34c4e189239d05c1e79579e99c396221540251c7b8809b6f002ee247a53f74db42f
-
Filesize
1.4MB
MD59a9ad45ee8872ee2bfec50b61caf9547
SHA138a7e426161343620a94eed44783a4ba091e0689
SHA256243f4ea2989fd7243a2d9199424ad93de2ab95bf2d2caf7105955927c5dbee77
SHA512cba5cdd15258781e96006f80d867a8501db3bdd6730a9db8fd5f37533b82e2dd923ae1335f6b0e1fc799b33036a3e3101766ad61b538d2274185243fd66f642a
-
Filesize
1.2MB
MD5daa55b780f54425ac90799290a6dbcaf
SHA1a907cce2a7f3b4cd366f11ab12fb1f02c68b52e3
SHA256514bca5747fbafaf40d037c87acea8177af6950a6363f05eb8798667cca06ddb
SHA5125a9caa30bdb913dea17c4c2df93fba5f7cc7bb7fd664b028032f6702345132b3cfb8fb08d8ab8b937bef7bf7b63b9bc05f44abbecc0811eaa23f3b44f6667efa
-
Filesize
1.3MB
MD5bbd4aae8b8f764c63d1158362bc54a42
SHA1e23d4695d1f1f0f057334869076dc9e644f6e164
SHA2561b6217c833d1ca65261af1b4bb95660e73be8126cf407acb3955adb63317ad37
SHA512238c980da7fb900a6f79334eef041b456fdc213f844f9c8b018bfc07c8d6f0ae64d3b27e7f6f9567e4b110fa398088e1f5c356939ab694e537a8f9dd6a2d6f53
-
Filesize
1.4MB
MD5ae203fedc712a80a7e229ddc7a66d72e
SHA113827caa404b798462fb9f31caf0f9fb9fd2cb25
SHA256afe646c81debe3674655955f725c7184f418467fe8961a90c8f3158c03814b92
SHA512d710e3f98e761b785766c973194ed2183ce84ee2d751857e247db60be37859f2702baea27979533016590b8d0e2c8b43274859c38d8add608a944ac4ce276c89
-
Filesize
2.1MB
MD5ca013f4e1eb651d8080643b748fc2668
SHA14b11b367f94b8d0be0feffab060286ac658af57a
SHA256797b1327c326aeb87ad779b6e3a3456930054c02513b9e8db11b595e8797a723
SHA51216fd3a36abdc3d2da0f76e7af4d26bfa4335204185d9e2e152422c0fc144cf7437902775c0ed18b3cc0a906246bad13b28f1f10b9cf7679186764fa334087c14
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
292KB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.4MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
1.6MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB