darkcloud | e1156b2e6b8500afa5e8a45d46a3420a33be357d5af362a224dc39e253fc720f

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 09:32

Target

PURCHASE ORDER.exe
Size

934KB
MD5

687acf4479fbd86277fdf370e9535e85
SHA1

87411fc5d13aef29b17d5a54cadb4dbb0245d78e
SHA256

e1156b2e6b8500afa5e8a45d46a3420a33be357d5af362a224dc39e253fc720f
SHA512

203804252fd845ee662f191e6961869f9aada361d4b1ad4ab493eb616221babbab5a17f58bc1b6f5dd22ef557b3f90cd491006b26730dd1996d7002a0b7320ac
SSDEEP

24576:RN6GEf3tyqvbEtsJElhBstN+YDFt9/FGm72BZcHuE:b6hfgOQtMB/Hl8hZcHuE

Score

10^/10

darkcloud stealer

Family

darkcloud

https://api.telegram.org/bot6267068129:AAE4AO_gQGAeEakYl26r7KthrUjdWAdy5c0/sendMessage?chat_id=1909112828

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4920 set thread context of 2916	4920	PURCHASE ORDER.exe	95

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2916	PURCHASE ORDER.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2916	PURCHASE ORDER.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2916	4920	PURCHASE ORDER.exe	95
PID 4920 wrote to memory of 2916	4920	PURCHASE ORDER.exe	95
PID 4920 wrote to memory of 2916	4920	PURCHASE ORDER.exe	95
PID 4920 wrote to memory of 2916	4920	PURCHASE ORDER.exe	95
PID 4920 wrote to memory of 2916	4920	PURCHASE ORDER.exe	95
PID 4920 wrote to memory of 2916	4920	PURCHASE ORDER.exe	95
PID 4920 wrote to memory of 2916	4920	PURCHASE ORDER.exe	95
PID 4920 wrote to memory of 2916	4920	PURCHASE ORDER.exe	95

memory/2916-142-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2916-149-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2916-145-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4920-136-0x00000000058A0000-0x0000000005932000-memory.dmp

Filesize
584KB

Download
memory/4920-137-0x0000000005B30000-0x0000000005B40000-memory.dmp

Filesize
64KB

Download
memory/4920-138-0x0000000005860000-0x000000000586A000-memory.dmp

Filesize
40KB

Download
memory/4920-139-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/4920-140-0x0000000005B30000-0x0000000005B40000-memory.dmp

Filesize
64KB

Download
memory/4920-141-0x00000000098D0000-0x000000000996C000-memory.dmp

Filesize
624KB

Download
memory/4920-133-0x0000000000D90000-0x0000000000E80000-memory.dmp

Filesize
960KB

Download
memory/4920-135-0x0000000005E50000-0x00000000063F4000-memory.dmp

Filesize
5.6MB

Download
memory/4920-148-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/4920-134-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download