darkcloud | 88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4

Analysis

max time kernel
58s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 10:56

Target

88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe
Size

1.0MB
MD5

5ebb62559516fb958bdf60a442a3ee52
SHA1

259aaad2a024dafe06bc1288cf3c6e049a703270
SHA256

88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4
SHA512

7b06277b12502109690fb0ce717d9907e8616d398ac26b60f069e89320af73de0df2845e39af086d1c2c519e3055c40db4bab704d93da276d648b466c7b8cba4
SSDEEP

24576:Z/thewlqB6pb1oxhCdsWAsgn5QPhLMILZhAuwUTSYzHOEkHT:de2q8p5oxI1FqShgIJX

Score

10^/10

darkcloud stealer

Family

darkcloud

Attributes

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1912	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2060	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	28
PID 1768 wrote to memory of 2060	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	28
PID 1768 wrote to memory of 2060	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	28
PID 1768 wrote to memory of 2060	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	28
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29
PID 1768 wrote to memory of 1912	1768	88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe	29

C:\Users\Admin\AppData\Local\Temp\88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe
"C:\Users\Admin\AppData\Local\Temp\88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe
  "C:\Users\Admin\AppData\Local\Temp\88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe"
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe
  "C:\Users\Admin\AppData\Local\Temp\88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1912

memory/1768-54-0x00000000002B0000-0x00000000003BC000-memory.dmp

Filesize
1.0MB

Download
memory/1768-55-0x00000000005B0000-0x00000000005F0000-memory.dmp

Filesize
256KB

Download
memory/1768-56-0x0000000000560000-0x0000000000572000-memory.dmp

Filesize
72KB

Download
memory/1768-57-0x00000000005B0000-0x00000000005F0000-memory.dmp

Filesize
256KB

Download
memory/1768-58-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/1768-59-0x0000000008040000-0x00000000080F8000-memory.dmp

Filesize
736KB

Download
memory/1768-60-0x0000000008100000-0x0000000008186000-memory.dmp

Filesize
536KB

Download
memory/1912-61-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1912-62-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1912-63-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1912-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1912-66-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1912-68-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1912-71-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1912-72-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download