darkcloud | 3e4c08f6c576544f406c83ea2361fadddc27361044b615e391fff3d9bf4e4ca2

Analysis

max time kernel
147s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08152023 List.eml.exe
Size 754KB
Sample230815-v3n95aee5v
SHA256 3e4c08f6c576544f406c83ea2361fadddc27361044b615e391fff3d9bf4e4ca2
MD5 e31b955623e2c260d64ecd239fc3198e
SHA1 f9598812dd9ae90c1b5cd1df02931b06905fa637
SHA512 abf10dbb73023f3ca98a214a6807efc024814fb97355e63c38aa8a50a94bb6e2550a96b9831c2e5771c6889defeb74d8e701514002630b8fddb6cf8c22431efa
SSDEEP 12288:ZyJV/ODaCj00t0ZHt/CX0HoddDRKRt3Sz7g//hVvR2lggdyI2jMVk:Zy2eh0t0Fto0gDERMnc/rROdq3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud stealer

Malware Config

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 2860	1944	08152023 List.eml.exe	31

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	08152023 List.eml.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	08152023 List.eml.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	08152023 List.eml.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2860	08152023 List.eml.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2856	1944	08152023 List.eml.exe	30
PID 1944 wrote to memory of 2856	1944	08152023 List.eml.exe	30
PID 1944 wrote to memory of 2856	1944	08152023 List.eml.exe	30
PID 1944 wrote to memory of 2856	1944	08152023 List.eml.exe	30
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31
PID 1944 wrote to memory of 2860	1944	08152023 List.eml.exe	31

C:\Users\Admin\AppData\Local\Temp\08152023 List.eml.exe
"C:\Users\Admin\AppData\Local\Temp\08152023 List.eml.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\08152023 List.eml.exe
  "C:\Users\Admin\AppData\Local\Temp\08152023 List.eml.exe"
  2⤵
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\08152023 List.eml.exe
  "C:\Users\Admin\AppData\Local\Temp\08152023 List.eml.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-74-0x0000000074B80000-0x000000007526E000-memory.dmp

Download

memory/1944-55-0x0000000074B80000-0x000000007526E000-memory.dmp

Download

memory/1944-56-0x0000000004C20000-0x0000000004C60000-memory.dmp

Download

memory/1944-57-0x0000000000550000-0x0000000000560000-memory.dmp

Download

memory/1944-58-0x0000000074B80000-0x000000007526E000-memory.dmp

Download

memory/1944-59-0x0000000004C20000-0x0000000004C60000-memory.dmp

Download

memory/1944-60-0x00000000005B0000-0x00000000005BE000-memory.dmp

Download

memory/1944-61-0x0000000005790000-0x0000000005832000-memory.dmp

Download

memory/1944-54-0x0000000000070000-0x0000000000132000-memory.dmp

Download

memory/2860-62-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2860-66-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2860-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2860-70-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2860-72-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2860-64-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2860-76-0x0000000000400000-0x0000000000462000-memory.dmp

Download