darkcloud | d1fcb7d17c9a3b228c9ae974d5ec478212c77eb17f4abff26c400f92dc42a6d0

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Overdue OA payment.exe
Size 759KB
Sample230815-ja8yaabd81
SHA256 d1fcb7d17c9a3b228c9ae974d5ec478212c77eb17f4abff26c400f92dc42a6d0
MD5 98bb403612f7b703221cf8ff8024a2f5
SHA1 d5ae4208fe0f8de0def874148de4bd6c6b3b0ac0
SHA512 76ffc762d758e5ffa3baf633493f776f21dba5e80ac2febd308b6f1bece0b4a4d66ed4d4de75aa1cf58e19d27549b320c3708879955acbc2113767d5e2de855f
SSDEEP 12288:4qq8jW8aZZQ4UZ+9DHIowluNPuQtCBipQLpvmUMykv0V56/qUVQ0p+1j2lj5:1qCW874C+9Doowludhty5CykvA56/qK9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

https://api.telegram.org/bot6201772437:AAE8z2HCV4dlViF8O7_bVozdyvuR6EkBCPA/sendMessage?chat_id=1909112828

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1168	1980	Overdue OA payment.exe	89

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1168	Overdue OA payment.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1168	Overdue OA payment.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1168	1980	Overdue OA payment.exe	89
PID 1980 wrote to memory of 1168	1980	Overdue OA payment.exe	89
PID 1980 wrote to memory of 1168	1980	Overdue OA payment.exe	89
PID 1980 wrote to memory of 1168	1980	Overdue OA payment.exe	89
PID 1980 wrote to memory of 1168	1980	Overdue OA payment.exe	89
PID 1980 wrote to memory of 1168	1980	Overdue OA payment.exe	89
PID 1980 wrote to memory of 1168	1980	Overdue OA payment.exe	89
PID 1980 wrote to memory of 1168	1980	Overdue OA payment.exe	89

C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe
"C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe
  "C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-142-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1168-149-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1168-145-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1980-136-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Download

memory/1980-137-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Download

memory/1980-138-0x0000000004D30000-0x0000000004D3A000-memory.dmp

Download

memory/1980-139-0x00000000058D0000-0x000000000596C000-memory.dmp

Download

memory/1980-140-0x0000000074E60000-0x0000000075610000-memory.dmp

Download

memory/1980-141-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Download

memory/1980-133-0x0000000074E60000-0x0000000075610000-memory.dmp

Download

memory/1980-135-0x0000000005280000-0x0000000005824000-memory.dmp

Download

memory/1980-147-0x0000000074E60000-0x0000000075610000-memory.dmp

Download

memory/1980-134-0x00000000001B0000-0x0000000000272000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads