darkcloud | adf9f5338648833c0b4bf2e10f1132340bd0cb7b8e1141c5b723bc95c82794d0

General

Target

documents.exe
Size

911KB
MD5

9530a4b5c2772de4edb6005f057c0405
SHA1

f544295bc15e8c1f69e9c2939acc88decfe404c8
SHA256

6e94f38fee814023e77c4f2f3f718fd0bdf456974fb7742c03ee17dd2054050c
SHA512

62d66a9cdaa81a4e651711dfa27de2dd0269a3200da8f62dd91a479bc925198caa9b4090cdf2e509832b9d226f1d33b28f5f66f6a30c7f0ad39f8f0e3f5f56ed
SSDEEP

12288:8SGnBbC8IABQRIVa8Tt5g0IhUSIw28Ph0S0NrlhjT2E6JbkpjPJaGbrKHaYl18/d:NEC+BVTUZX2HjTz6pmddYl10

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

Attributes

email_from
[email protected]
email_to
[email protected]

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Suspicious use of SetThreadContext 1 IoCs

Processes:

documents.exe

description pid process target process

PID 2232 set thread context of 2788 2232 documents.exe documents.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2920 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

documents.exepowershell.exe

pid process

2232 documents.exe
2232 documents.exe
2232 documents.exe
2232 documents.exe
2232 documents.exe
2232 documents.exe
2232 documents.exe
2740 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

documents.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2232 documents.exe
Token: SeDebugPrivilege 2740 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

documents.exe

pid process

2788 documents.exe

description	pid	process	target process
PID 2232 set thread context of 2788	2232	documents.exe	documents.exe

pid	process
2920	schtasks.exe

pid	process
2232	documents.exe
2232	documents.exe
2232	documents.exe
2232	documents.exe
2232	documents.exe
2232	documents.exe
2232	documents.exe
2740	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2232	documents.exe
Token: SeDebugPrivilege	2740	powershell.exe

pid	process
2788	documents.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

documents.exe

description	pid	process	target process
PID 2232 wrote to memory of 2740	2232	documents.exe	powershell.exe
PID 2232 wrote to memory of 2740	2232	documents.exe	powershell.exe
PID 2232 wrote to memory of 2740	2232	documents.exe	powershell.exe
PID 2232 wrote to memory of 2740	2232	documents.exe	powershell.exe
PID 2232 wrote to memory of 2920	2232	documents.exe	schtasks.exe
PID 2232 wrote to memory of 2920	2232	documents.exe	schtasks.exe
PID 2232 wrote to memory of 2920	2232	documents.exe	schtasks.exe
PID 2232 wrote to memory of 2920	2232	documents.exe	schtasks.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe
PID 2232 wrote to memory of 2788	2232	documents.exe	documents.exe

C:\Users\Admin\AppData\Local\Temp\documents.exe
"C:\Users\Admin\AppData\Local\Temp\documents.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XDtKGBXwHkOLmY.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XDtKGBXwHkOLmY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp78E7.tmp"
2⤵
- Creates scheduled task(s)
PID:2920

C:\Users\Admin\AppData\Local\Temp\documents.exe
"C:\Users\Admin\AppData\Local\Temp\documents.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2788

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp78E7.tmp
Filesize
1KB

MD5
289b83b32fbe94c5cc88b381446e27e0

SHA1
13049f55ce5b54baaa94ef899f755737d1e25048

SHA256
90c80f0d01993487b2399d501105aa8c00acfb21e1edd6fc194722f0e9f32746

SHA512
f000eefe6afb949518e7b534cbc12a5fb4edd7996fe4bf49edea5f0f8852c4b20c9a7fc69b47299268654f21ad2b5c908ea3f26038486fcbd326386ee9715830

Download Submit
memory/2232-27-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2232-1-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2232-2-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/2232-3-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/2232-4-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/2232-5-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/2232-6-0x0000000004850000-0x00000000048F2000-memory.dmp

Filesize
648KB

Download
memory/2232-7-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2232-8-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/2232-0-0x0000000000CC0000-0x0000000000DAA000-memory.dmp

Filesize
936KB

Download
memory/2740-29-0x0000000002870000-0x00000000028B0000-memory.dmp

Filesize
256KB

Download
memory/2740-26-0x000000006E510000-0x000000006EABB000-memory.dmp

Filesize
5.7MB

Download
memory/2740-30-0x000000006E510000-0x000000006EABB000-memory.dmp

Filesize
5.7MB

Download
memory/2740-31-0x0000000002870000-0x00000000028B0000-memory.dmp

Filesize
256KB

Download
memory/2740-33-0x000000006E510000-0x000000006EABB000-memory.dmp

Filesize
5.7MB

Download
memory/2788-16-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2788-22-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2788-24-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2788-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2788-18-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2788-17-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2788-32-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2788-34-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads