Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:12

General

  • Target

    receipt of full payment.exe

  • Size

    918KB

  • MD5

    dc8adcc624f9599d45e5e3b63411e4c7

  • SHA1

    65f0b0f038f3969d5080ec79ce559093b217c467

  • SHA256

    2c2ca8d1a75eef32da01814983a7a3dbddff14915ae96346af68dc29c65db7ea

  • SHA512

    51443b901a0abd5a74d69e22ec66367604a3b4005256efe3c96c843e5873ec158cec4dcc647508ca682975434514cf88977f170b6586bc31ae69b360919ce41e

  • SSDEEP

    12288:mlUgySozdUd283S5qgkFCxjI4s+gGL+i7vJ0TG/r7jam+VM/NwNVJdPFZdVBo6U1:8mFudCDkFCx84OG9Brj7emT/NCVJdz

Malware Config

Extracted

Family

darkcloud

Attributes

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Kinsing

    Kinsing is a loader written in Golang.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\receipt of full payment.exe
    "C:\Users\Admin\AppData\Local\Temp\receipt of full payment.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\receipt of full payment.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VpfYGImQGmj.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3520
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VpfYGImQGmj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB1AC.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4268
    • C:\Users\Admin\AppData\Local\Temp\receipt of full payment.exe
      "C:\Users\Admin\AppData\Local\Temp\receipt of full payment.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:60

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    5d93829a00bbe784dc4f15f781013051

    SHA1

    7a20cb9ee19b54712cd60de23148302c18b15350

    SHA256

    9319e02af74869f0ba3ddedc64f33328c32a8618795ec03550a0afc68a816a3c

    SHA512

    a85053cd4d2f30692eef426b7dcfd7be51d1e2befdaff24636f74392477d30a4c1aba20fb0918ba5db47ad6a5f164ff04a346c786699b166d7308d51a9fe011c

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pdwvbw0j.mar.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpB1AC.tmp

    Filesize

    1KB

    MD5

    80f5ec2cb220dae8cb8ddb25b7ee5d0d

    SHA1

    7c17c97a012d9e4ddadf808d961150f5af9148a1

    SHA256

    eba1ecf8fab31e9cfa9c89ef739cdc7144501c0bb082755cde72129277966ad7

    SHA512

    420110cda37ad54028dfd6a908a58667eaf116776875ada118ba6c263ec12ea68a339c392e83892c5d794c0b71e94316a59e2a67e8196ef4baa647b37169c4d8

  • memory/60-98-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/60-26-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/60-29-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1488-82-0x0000000007890000-0x00000000078AA000-memory.dmp

    Filesize

    104KB

  • memory/1488-53-0x0000000006560000-0x000000000657E000-memory.dmp

    Filesize

    120KB

  • memory/1488-96-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/1488-89-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

    Filesize

    104KB

  • memory/1488-87-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

    Filesize

    56KB

  • memory/1488-88-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

    Filesize

    80KB

  • memory/1488-18-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/1488-17-0x0000000004FC0000-0x0000000004FF6000-memory.dmp

    Filesize

    216KB

  • memory/1488-19-0x0000000005060000-0x0000000005070000-memory.dmp

    Filesize

    64KB

  • memory/1488-20-0x0000000005060000-0x0000000005070000-memory.dmp

    Filesize

    64KB

  • memory/1488-21-0x00000000056A0000-0x0000000005CC8000-memory.dmp

    Filesize

    6.2MB

  • memory/1488-86-0x0000000007A90000-0x0000000007AA1000-memory.dmp

    Filesize

    68KB

  • memory/1488-55-0x000000007F030000-0x000000007F040000-memory.dmp

    Filesize

    64KB

  • memory/1488-24-0x00000000055A0000-0x00000000055C2000-memory.dmp

    Filesize

    136KB

  • memory/1488-56-0x0000000006B40000-0x0000000006B72000-memory.dmp

    Filesize

    200KB

  • memory/1488-84-0x0000000007910000-0x000000000791A000-memory.dmp

    Filesize

    40KB

  • memory/1488-69-0x00000000716A0000-0x00000000716EC000-memory.dmp

    Filesize

    304KB

  • memory/1488-81-0x0000000005060000-0x0000000005070000-memory.dmp

    Filesize

    64KB

  • memory/3520-22-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/3520-25-0x0000000005120000-0x0000000005186000-memory.dmp

    Filesize

    408KB

  • memory/3520-97-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/3520-41-0x0000000005420000-0x0000000005774000-memory.dmp

    Filesize

    3.3MB

  • memory/3520-54-0x0000000005A30000-0x0000000005A7C000-memory.dmp

    Filesize

    304KB

  • memory/3520-68-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

    Filesize

    120KB

  • memory/3520-58-0x000000007F4C0000-0x000000007F4D0000-memory.dmp

    Filesize

    64KB

  • memory/3520-90-0x0000000007040000-0x0000000007048000-memory.dmp

    Filesize

    32KB

  • memory/3520-80-0x00000000069E0000-0x0000000006A83000-memory.dmp

    Filesize

    652KB

  • memory/3520-70-0x00000000020D0000-0x00000000020E0000-memory.dmp

    Filesize

    64KB

  • memory/3520-85-0x0000000006FA0000-0x0000000007036000-memory.dmp

    Filesize

    600KB

  • memory/3520-57-0x00000000716A0000-0x00000000716EC000-memory.dmp

    Filesize

    304KB

  • memory/3520-83-0x0000000007370000-0x00000000079EA000-memory.dmp

    Filesize

    6.5MB

  • memory/3520-28-0x00000000053B0000-0x0000000005416000-memory.dmp

    Filesize

    408KB

  • memory/4420-5-0x0000000003130000-0x000000000313A000-memory.dmp

    Filesize

    40KB

  • memory/4420-40-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4420-8-0x00000000092B0000-0x00000000092B8000-memory.dmp

    Filesize

    32KB

  • memory/4420-7-0x000000000A710000-0x000000000A7AC000-memory.dmp

    Filesize

    624KB

  • memory/4420-6-0x00000000081E0000-0x00000000081F4000-memory.dmp

    Filesize

    80KB

  • memory/4420-12-0x0000000007FC0000-0x0000000007FD0000-memory.dmp

    Filesize

    64KB

  • memory/4420-11-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4420-1-0x0000000074EB0000-0x0000000075660000-memory.dmp

    Filesize

    7.7MB

  • memory/4420-10-0x000000000AA40000-0x000000000AAE2000-memory.dmp

    Filesize

    648KB

  • memory/4420-3-0x0000000007D80000-0x0000000007E12000-memory.dmp

    Filesize

    584KB

  • memory/4420-4-0x0000000007FC0000-0x0000000007FD0000-memory.dmp

    Filesize

    64KB

  • memory/4420-9-0x00000000092C0000-0x00000000092CC000-memory.dmp

    Filesize

    48KB

  • memory/4420-2-0x0000000008290000-0x0000000008834000-memory.dmp

    Filesize

    5.6MB

  • memory/4420-0-0x0000000000D90000-0x0000000000E7C000-memory.dmp

    Filesize

    944KB