Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2023, 06:40

General

  • Target

    PRE ALERT DOCUMENTS.exe

  • Size

    905KB

  • MD5

    c1128956f3a5d97d01eb3a9a63fce28e

  • SHA1

    24472f38948b2bc2e7fcce07d3ba6f68a78b06d1

  • SHA256

    83c649919324adc6fddf8db7fbfb4750b8d990e0d1a25edda7b4f0cdcd044d05

  • SHA512

    55576b2afe96c9948b6503f46377b682714b818a97f02407b7a46a6212320f794b50d812eac1c35245fff966b790857a399a5835fc173c76882a2526f7cd3296

  • SSDEEP

    12288:lMS6ln+flo/XciMvDlFonmnE3eNOLyS/H/g1EpBDi34fp2GYfpdS0/WliOVAy/Mn:lFTdCjEsKieONco6cYvS0/9OVAy/L

Score
10/10

Malware Config

Extracted

Family

darkcloud

Attributes

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PRE ALERT DOCUMENTS.exe
    "C:\Users\Admin\AppData\Local\Temp\PRE ALERT DOCUMENTS.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pUGagPvAp.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4428
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pUGagPvAp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1DA5.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1964
    • C:\Users\Admin\AppData\Local\Temp\PRE ALERT DOCUMENTS.exe
      "C:\Users\Admin\AppData\Local\Temp\PRE ALERT DOCUMENTS.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m5js0aic.toz.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp1DA5.tmp

    Filesize

    1KB

    MD5

    4cd9a7ff9d742e3e140cd99010fc9d51

    SHA1

    f27647a29462c02131a8edcd1736a148db455e81

    SHA256

    77c375d6be9219ab77be3748fe681ad6de6cf37f7c1bd91584ff62a98430b25d

    SHA512

    5af43d15e15d82e67b4173195a8d0ee36892b39c4352927f592820b83488d2119328a7a4fb713cf8c9b89a7d55fcc659d27dacefe88566349a08288578054547

  • memory/2944-195-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/2944-151-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/2944-154-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/3920-136-0x0000000005720000-0x00000000057B2000-memory.dmp

    Filesize

    584KB

  • memory/3920-139-0x00000000059D0000-0x0000000005A6C000-memory.dmp

    Filesize

    624KB

  • memory/3920-140-0x00000000745C0000-0x0000000074D70000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-141-0x0000000005920000-0x0000000005930000-memory.dmp

    Filesize

    64KB

  • memory/3920-138-0x00000000056C0000-0x00000000056CA000-memory.dmp

    Filesize

    40KB

  • memory/3920-137-0x0000000005920000-0x0000000005930000-memory.dmp

    Filesize

    64KB

  • memory/3920-133-0x0000000000C20000-0x0000000000D08000-memory.dmp

    Filesize

    928KB

  • memory/3920-135-0x0000000005CD0000-0x0000000006274000-memory.dmp

    Filesize

    5.6MB

  • memory/3920-155-0x00000000745C0000-0x0000000074D70000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-134-0x00000000745C0000-0x0000000074D70000-memory.dmp

    Filesize

    7.7MB

  • memory/4428-159-0x0000000005060000-0x00000000050C6000-memory.dmp

    Filesize

    408KB

  • memory/4428-184-0x00000000078E0000-0x0000000007F5A000-memory.dmp

    Filesize

    6.5MB

  • memory/4428-157-0x0000000004FC0000-0x0000000004FE2000-memory.dmp

    Filesize

    136KB

  • memory/4428-149-0x0000000004C20000-0x0000000004C30000-memory.dmp

    Filesize

    64KB

  • memory/4428-160-0x0000000005990000-0x00000000059F6000-memory.dmp

    Filesize

    408KB

  • memory/4428-147-0x00000000745C0000-0x0000000074D70000-memory.dmp

    Filesize

    7.7MB

  • memory/4428-170-0x0000000005F70000-0x0000000005F8E000-memory.dmp

    Filesize

    120KB

  • memory/4428-171-0x0000000004C20000-0x0000000004C30000-memory.dmp

    Filesize

    64KB

  • memory/4428-172-0x0000000006F20000-0x0000000006F52000-memory.dmp

    Filesize

    200KB

  • memory/4428-173-0x0000000070880000-0x00000000708CC000-memory.dmp

    Filesize

    304KB

  • memory/4428-183-0x0000000006540000-0x000000000655E000-memory.dmp

    Filesize

    120KB

  • memory/4428-150-0x0000000005260000-0x0000000005888000-memory.dmp

    Filesize

    6.2MB

  • memory/4428-185-0x00000000072A0000-0x00000000072BA000-memory.dmp

    Filesize

    104KB

  • memory/4428-186-0x0000000007310000-0x000000000731A000-memory.dmp

    Filesize

    40KB

  • memory/4428-187-0x0000000007520000-0x00000000075B6000-memory.dmp

    Filesize

    600KB

  • memory/4428-188-0x00000000074D0000-0x00000000074DE000-memory.dmp

    Filesize

    56KB

  • memory/4428-189-0x00000000075E0000-0x00000000075FA000-memory.dmp

    Filesize

    104KB

  • memory/4428-190-0x00000000075C0000-0x00000000075C8000-memory.dmp

    Filesize

    32KB

  • memory/4428-191-0x00000000745C0000-0x0000000074D70000-memory.dmp

    Filesize

    7.7MB

  • memory/4428-192-0x0000000004C20000-0x0000000004C30000-memory.dmp

    Filesize

    64KB

  • memory/4428-194-0x00000000745C0000-0x0000000074D70000-memory.dmp

    Filesize

    7.7MB

  • memory/4428-146-0x0000000002650000-0x0000000002686000-memory.dmp

    Filesize

    216KB