Analysis

  • max time kernel
    119s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2023, 04:04

General

  • Target

    2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe

  • Size

    3.0MB

  • MD5

    e1f944688e00a6753e1dfa4e5d8a7670

  • SHA1

    bc4ac9ef640a74fcf240f14def4948ec6e9346c4

  • SHA256

    2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9

  • SHA512

    a469ee8b8771b47ef185bacc7853fdf253533725da9e0f19543e5c38a273a344658808de6e10d2802b2548284778575d9a2b60b611a58e292d1a2f0132e04dc6

  • SSDEEP

    24576:V5KrtzH/iYOdy9HQUtiImGqPPUPJp6XdCGQV3JfIR:CrxH/iYV9VeGqPPsT6UvrQR

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot6398598832:AAHm_-Bk4WvgvnFiJw5HCNBQ9z3BfEFNArM/sendMessage?chat_id=5713547588

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe
    "C:\Users\Admin\AppData\Local\Temp\2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Users\Admin\AppData\Local\Temp\2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe
      "C:\Users\Admin\AppData\Local\Temp\2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GLqLto.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4012
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GLqLto" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8DC4.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:4708
      • C:\Users\Admin\AppData\Local\Temp\2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe
        "C:\Users\Admin\AppData\Local\Temp\2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:4284
    • C:\Users\Admin\AppData\Local\Temp\chrome.exe
      "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Users\Admin\AppData\Local\Temp\chrome.exe
        "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
        3⤵
        • Executes dropped EXE
        PID:1540
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\svchost"
        3⤵
          PID:4928
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4836
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
            4⤵
            • Creates scheduled task(s)
            PID:2872
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\chrome.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
          3⤵
            PID:4140
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\chrome"
          2⤵
            PID:4816
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chrome\chrome.exe'" /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2496
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chrome\chrome.exe'" /f
              3⤵
              • Creates scheduled task(s)
              PID:64
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe" "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
            2⤵
              PID:4700
          • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
            C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
            1⤵
            • Executes dropped EXE
            PID:3064
            • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
              "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
              2⤵
                PID:4604
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\svchost"
                2⤵
                  PID:1968

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9.exe.log

                Filesize

                520B

                MD5

                03febbff58da1d3318c31657d89c8542

                SHA1

                c9e017bd9d0a4fe533795b227c855935d86c2092

                SHA256

                5164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4

                SHA512

                3750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5awcl2lf.edm.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\chrome.exe

                Filesize

                2.0MB

                MD5

                b3d8ceb7e2bfbe5f089d81312632b27f

                SHA1

                4cb60364f395dac0fe6b56d3130a9d4ff39d0fc6

                SHA256

                cf00a8bab3af58f4e0809febf8707b6b4c4e67f46140cd273d468425d012c54f

                SHA512

                9e5be6621a4820dd86e1285d0d64283c3bcb70576a1fee0e9bb21c2a4afceed8df363f8537870192397bb6897e0e8160334a01ca97d50cacff6e9d38b2ce259f

              • C:\Users\Admin\AppData\Local\Temp\chrome.exe

                Filesize

                2.0MB

                MD5

                b3d8ceb7e2bfbe5f089d81312632b27f

                SHA1

                4cb60364f395dac0fe6b56d3130a9d4ff39d0fc6

                SHA256

                cf00a8bab3af58f4e0809febf8707b6b4c4e67f46140cd273d468425d012c54f

                SHA512

                9e5be6621a4820dd86e1285d0d64283c3bcb70576a1fee0e9bb21c2a4afceed8df363f8537870192397bb6897e0e8160334a01ca97d50cacff6e9d38b2ce259f

              • C:\Users\Admin\AppData\Local\Temp\chrome.exe

                Filesize

                2.0MB

                MD5

                b3d8ceb7e2bfbe5f089d81312632b27f

                SHA1

                4cb60364f395dac0fe6b56d3130a9d4ff39d0fc6

                SHA256

                cf00a8bab3af58f4e0809febf8707b6b4c4e67f46140cd273d468425d012c54f

                SHA512

                9e5be6621a4820dd86e1285d0d64283c3bcb70576a1fee0e9bb21c2a4afceed8df363f8537870192397bb6897e0e8160334a01ca97d50cacff6e9d38b2ce259f

              • C:\Users\Admin\AppData\Local\Temp\chrome.exe

                Filesize

                2.0MB

                MD5

                b3d8ceb7e2bfbe5f089d81312632b27f

                SHA1

                4cb60364f395dac0fe6b56d3130a9d4ff39d0fc6

                SHA256

                cf00a8bab3af58f4e0809febf8707b6b4c4e67f46140cd273d468425d012c54f

                SHA512

                9e5be6621a4820dd86e1285d0d64283c3bcb70576a1fee0e9bb21c2a4afceed8df363f8537870192397bb6897e0e8160334a01ca97d50cacff6e9d38b2ce259f

              • C:\Users\Admin\AppData\Local\Temp\tmp8DC4.tmp

                Filesize

                1KB

                MD5

                42447d06b385f2b938f2a0a17309347b

                SHA1

                a83fe35199ae6bc61ebfc0106aa92aa255f58b6b

                SHA256

                926ef1467e1e52abc8516e5a2fab624679ded69d1cb98beacc7f1a7750c0ff70

                SHA512

                60a8b2ab6a50dfd62b742d5057321521ca86ecfa081057b3d90abd2223ae70c8f383fe971aa4a7dd4ca0709df83ac55677917824fe9c5bac613f154953648f85

              • C:\Users\Admin\AppData\Roaming\GLqLto.exe

                Filesize

                3.0MB

                MD5

                e1f944688e00a6753e1dfa4e5d8a7670

                SHA1

                bc4ac9ef640a74fcf240f14def4948ec6e9346c4

                SHA256

                2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9

                SHA512

                a469ee8b8771b47ef185bacc7853fdf253533725da9e0f19543e5c38a273a344658808de6e10d2802b2548284778575d9a2b60b611a58e292d1a2f0132e04dc6

              • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

                Filesize

                2.0MB

                MD5

                b3d8ceb7e2bfbe5f089d81312632b27f

                SHA1

                4cb60364f395dac0fe6b56d3130a9d4ff39d0fc6

                SHA256

                cf00a8bab3af58f4e0809febf8707b6b4c4e67f46140cd273d468425d012c54f

                SHA512

                9e5be6621a4820dd86e1285d0d64283c3bcb70576a1fee0e9bb21c2a4afceed8df363f8537870192397bb6897e0e8160334a01ca97d50cacff6e9d38b2ce259f

              • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

                Filesize

                2.0MB

                MD5

                b3d8ceb7e2bfbe5f089d81312632b27f

                SHA1

                4cb60364f395dac0fe6b56d3130a9d4ff39d0fc6

                SHA256

                cf00a8bab3af58f4e0809febf8707b6b4c4e67f46140cd273d468425d012c54f

                SHA512

                9e5be6621a4820dd86e1285d0d64283c3bcb70576a1fee0e9bb21c2a4afceed8df363f8537870192397bb6897e0e8160334a01ca97d50cacff6e9d38b2ce259f

              • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

                Filesize

                1.1MB

                MD5

                7883a9e6cdcd516f2795d49ee653ef46

                SHA1

                e37d8d75893d357257878de40a41e98bd5761337

                SHA256

                358df27af8cf001d3fed50e27ab9281705bc74f49c714ec30460256c81b33b1b

                SHA512

                e484312ee326aea5f2505db6ec37aa0cc4b991b3cf20c20ce0fa303ea5c5876a821edd8581a3bfbfd638c2836f167063ae715fdf8d0fbe65cde0b12eb10ab39d

              • memory/1012-134-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1012-138-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

                Filesize

                64KB

              • memory/1012-137-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1012-136-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

                Filesize

                64KB

              • memory/1012-135-0x0000000005380000-0x0000000005924000-memory.dmp

                Filesize

                5.6MB

              • memory/1012-133-0x0000000000150000-0x0000000000454000-memory.dmp

                Filesize

                3.0MB

              • memory/1012-161-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1540-168-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1540-169-0x00000000057A0000-0x00000000057B0000-memory.dmp

                Filesize

                64KB

              • memory/1540-205-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1540-206-0x00000000057A0000-0x00000000057B0000-memory.dmp

                Filesize

                64KB

              • memory/1540-166-0x0000000000400000-0x0000000000418000-memory.dmp

                Filesize

                96KB

              • memory/1580-162-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1580-191-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1580-163-0x0000000005A30000-0x0000000005A40000-memory.dmp

                Filesize

                64KB

              • memory/1580-170-0x0000000009A90000-0x0000000009B2C000-memory.dmp

                Filesize

                624KB

              • memory/1580-144-0x0000000005AD0000-0x0000000005ADA000-memory.dmp

                Filesize

                40KB

              • memory/1580-143-0x0000000005A30000-0x0000000005A40000-memory.dmp

                Filesize

                64KB

              • memory/1580-142-0x0000000005B10000-0x0000000005BA2000-memory.dmp

                Filesize

                584KB

              • memory/1580-141-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1580-139-0x0000000000400000-0x00000000004F8000-memory.dmp

                Filesize

                992KB

              • memory/1892-164-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1892-177-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1892-165-0x0000000002640000-0x0000000002650000-memory.dmp

                Filesize

                64KB

              • memory/1892-157-0x0000000002640000-0x0000000002650000-memory.dmp

                Filesize

                64KB

              • memory/1892-156-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/1892-155-0x0000000000470000-0x000000000049A000-memory.dmp

                Filesize

                168KB

              • memory/3064-235-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/3064-236-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/4012-181-0x0000000002290000-0x00000000022A0000-memory.dmp

                Filesize

                64KB

              • memory/4012-223-0x0000000006EC0000-0x0000000006ECA000-memory.dmp

                Filesize

                40KB

              • memory/4012-190-0x0000000004CF0000-0x0000000004D56000-memory.dmp

                Filesize

                408KB

              • memory/4012-204-0x0000000005B50000-0x0000000005B6E000-memory.dmp

                Filesize

                120KB

              • memory/4012-179-0x0000000000CE0000-0x0000000000D16000-memory.dmp

                Filesize

                216KB

              • memory/4012-189-0x0000000004AD0000-0x0000000004AF2000-memory.dmp

                Filesize

                136KB

              • memory/4012-207-0x0000000002290000-0x00000000022A0000-memory.dmp

                Filesize

                64KB

              • memory/4012-208-0x000000007F610000-0x000000007F620000-memory.dmp

                Filesize

                64KB

              • memory/4012-209-0x0000000006100000-0x0000000006132000-memory.dmp

                Filesize

                200KB

              • memory/4012-210-0x00000000711A0000-0x00000000711EC000-memory.dmp

                Filesize

                304KB

              • memory/4012-220-0x00000000060E0000-0x00000000060FE000-memory.dmp

                Filesize

                120KB

              • memory/4012-221-0x00000000074A0000-0x0000000007B1A000-memory.dmp

                Filesize

                6.5MB

              • memory/4012-222-0x0000000006E50000-0x0000000006E6A000-memory.dmp

                Filesize

                104KB

              • memory/4012-192-0x0000000005490000-0x00000000054F6000-memory.dmp

                Filesize

                408KB

              • memory/4012-224-0x00000000070D0000-0x0000000007166000-memory.dmp

                Filesize

                600KB

              • memory/4012-225-0x0000000007080000-0x000000000708E000-memory.dmp

                Filesize

                56KB

              • memory/4012-226-0x0000000007190000-0x00000000071AA000-memory.dmp

                Filesize

                104KB

              • memory/4012-227-0x0000000007170000-0x0000000007178000-memory.dmp

                Filesize

                32KB

              • memory/4012-228-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/4012-231-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/4012-180-0x0000000074E60000-0x0000000075610000-memory.dmp

                Filesize

                7.7MB

              • memory/4012-183-0x0000000002290000-0x00000000022A0000-memory.dmp

                Filesize

                64KB

              • memory/4012-184-0x0000000004E60000-0x0000000005488000-memory.dmp

                Filesize

                6.2MB

              • memory/4284-185-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/4284-232-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/4284-188-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB