darkcloud | 7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd

Analysis

max time kernel
161s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe
Size

1.4MB
MD5

d3f9c27bd4524cd81dc5b5c7949e48a4
SHA1

461fdb08d2c272897f3adee0f0668dc462612c71
SHA256

7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd
SHA512

0ced77a5df8fbcda7c1f0c1f8333822c62086314fbede54f25010762acea320a9281fc8f44d3e2d11f905964614d2f8f7d689b695f6f6338404b13bac43bb980
SSDEEP

24576:P8OP09xqIi4CdeZaqW1a8soHcxdBz7U2oGm8aO3ZmcL1UoQPqhnATyHtTI9srDru:eZKT8xdl7NlawZlGoQSniyHvrnu

Score

10^/10

darkcloud persistence stealer

Malware Config

Extracted

Family

darkcloud

Attributes

email_from
[email protected]
email_to
[email protected]

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vquovspaxe = "C:\\Users\\Admin\\AppData\\Roaming\\Vquovspaxe.exe"	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3860 set thread context of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4016	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4016	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87
PID 3860 wrote to memory of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87
PID 3860 wrote to memory of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87
PID 3860 wrote to memory of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87
PID 3860 wrote to memory of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87
PID 3860 wrote to memory of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87
PID 3860 wrote to memory of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87
PID 3860 wrote to memory of 4016	3860	7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe	87

C:\Users\Admin\AppData\Local\Temp\7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7bdbdf1864e94261b323235ffa2dd241a953f89dae35a2115662cac696e65dfd_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3860-37-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-23-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-2-0x00000000051E0000-0x0000000005784000-memory.dmp

Filesize
5.6MB

Download
memory/3860-3-0x0000000004CD0000-0x0000000004D62000-memory.dmp

Filesize
584KB

Download
memory/3860-4-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3860-5-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Filesize
40KB

Download
memory/3860-6-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-7-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-9-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-11-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-13-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-15-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-17-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-41-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-21-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-39-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-25-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-27-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-29-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-31-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-33-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-35-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-0-0x0000000000170000-0x00000000002D6000-memory.dmp

Filesize
1.4MB

Download
memory/3860-1-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/3860-19-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-43-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-45-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-47-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-49-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-51-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-53-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-55-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-57-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-59-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-61-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-63-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-65-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-67-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-69-0x00000000076B0000-0x000000000779D000-memory.dmp

Filesize
948KB

Download
memory/3860-1001-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/3860-1083-0x00000000077D0000-0x00000000077D1000-memory.dmp

Filesize
4KB

Download
memory/3860-1084-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3860-1093-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/4016-1091-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4016-1094-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads