darkcloud | 0ef8690ac5fbda00640852fe323d69dcc7df51d9a367070500d37529148a37df

General

Target

009029201_Alu Payment DUE Outstanding.exe
Size

911KB
MD5

6a796148a25bea3bec318ff96b9f6675
SHA1

3ef1b848f0b21feb225430f2f8609c3b12ed1339
SHA256

0ef8690ac5fbda00640852fe323d69dcc7df51d9a367070500d37529148a37df
SHA512

482336dc1ad64e909951187427d4c62c1dbcfb807d08f0413e6e2134624ba9e82b17b6b8164a2785427b9d30993a48296d38869b5277d62e8cda2c817f6bffba
SSDEEP

24576:+3jC+JA7QnoFGkqGsmzJqUfefRdxE/6vk:8m+7nooGsmzJqmepdi/6v

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5637864859:AAHatMmLjO3i5zaPb5Ppy5_wDiRtKwQUbSU/sendMessage?chat_id=5990783030

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3028	009029201_Alu Payment DUE Outstanding.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	009029201_Alu Payment DUE Outstanding.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	009029201_Alu Payment DUE Outstanding.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2808	009029201_Alu Payment DUE Outstanding.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1292	3028	009029201_Alu Payment DUE Outstanding.exe	28
PID 3028 wrote to memory of 1292	3028	009029201_Alu Payment DUE Outstanding.exe	28
PID 3028 wrote to memory of 1292	3028	009029201_Alu Payment DUE Outstanding.exe	28
PID 3028 wrote to memory of 1292	3028	009029201_Alu Payment DUE Outstanding.exe	28
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30
PID 3028 wrote to memory of 2808	3028	009029201_Alu Payment DUE Outstanding.exe	30

C:\Users\Admin\AppData\Local\Temp\009029201_Alu Payment DUE Outstanding.exe
"C:\Users\Admin\AppData\Local\Temp\009029201_Alu Payment DUE Outstanding.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dEraEFIkD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp93A8.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1292
- C:\Users\Admin\AppData\Local\Temp\009029201_Alu Payment DUE Outstanding.exe
  "{path}"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp93A8.tmp

Filesize
1KB

MD5
1d3f6f5781e74f0d3dd8ec8fad67c4be

SHA1
66818ba6f1dd7ae96904f387f6f673697bd4df7b

SHA256
45188da6569d25a472f5bf9f95abc905159aba9ed3b036bdcc0fc826938770f8

SHA512
52448779613ad842e8fadb3d2e688e5f2016d95915039203a825e8802248207a46bf87e9bbd31cc3d66cdfafb0df42d815c5fb8cbeb62d470cdaac74069e4f39

Download Submit
memory/2808-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2808-15-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2808-25-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2808-21-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2808-19-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2808-11-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2808-13-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3028-2-0x00000000043E0000-0x0000000004420000-memory.dmp

Filesize
256KB

Download
memory/3028-6-0x0000000005490000-0x0000000005542000-memory.dmp

Filesize
712KB

Download
memory/3028-1-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-7-0x00000000051F0000-0x0000000005270000-memory.dmp

Filesize
512KB

Download
memory/3028-0-0x00000000001F0000-0x00000000002DA000-memory.dmp

Filesize
936KB

Download
memory/3028-5-0x00000000043E0000-0x0000000004420000-memory.dmp

Filesize
256KB

Download
memory/3028-4-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-22-0x0000000074E30000-0x000000007551E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-3-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads