Analysis

  • max time kernel
    143s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2024 02:00

General

  • Target

    payment receipts.exe

  • Size

    986KB

  • MD5

    cdcfa8aab8a4766ddb88df4635104d83

  • SHA1

    7ad43cc7224f694995e53325a581e659eabe2e16

  • SHA256

    0414ef0adb12bfe054d85f9196cee419bee6a7692187d83239bd5f8ee867c4c8

  • SHA512

    9948e0571bfd8a167ad456a7aa4380b7f73f0bc77475b827bb20303a5fe1bce03670900e275cec573c88df51cd42a2060012bba623c7358640af8e1209210acb

  • SSDEEP

    24576:FJRsQJVHvu3/mAUf45P3z55KTBmfswlibk:bWgHv0wq50TAfpEk

Score
10/10

Malware Config

Extracted

Family

darkcloud

Attributes

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\payment receipts.exe
    "C:\Users\Admin\AppData\Local\Temp\payment receipts.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\payment receipts.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2248
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UbaskbOLQNa.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2788
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UbaskbOLQNa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB8E3.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2960
    • C:\Users\Admin\AppData\Local\Temp\payment receipts.exe
      "C:\Users\Admin\AppData\Local\Temp\payment receipts.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB8E3.tmp

    Filesize

    1KB

    MD5

    463cd327d3e513344550f47f1a84e4b0

    SHA1

    cab2121180c408fe2b13e0763f6eafad10fb8a4a

    SHA256

    985f73850f31683037816aa9b2bada09230a3231f1a427ccd695b02ab270dcdf

    SHA512

    cb6cdbd06cb8a204be1bc7835aa8b0d9aeca6697c349b4a30ed7978576a57813bd4ac7942fda873f5bde7c5772419a206833a5688cf89c41f9058d1ce847b707

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    59bf2f4d6b2d30afc4eb15e5b02c7a33

    SHA1

    a1cae98570e728c2f772fd7a3abd59197a29bd32

    SHA256

    6207e0c0c893e4bbea11a5d7e53cffc7ebdc04d97db6bc466b33ca517621f48b

    SHA512

    8b00b710e8b608de374b835a5e0c4d215e2b0ec4338ca24527bd62bfbbb41756deca66362ed41bae9a7939cff289a2471ba6ba49a7dd88aeeccc7981f9ceb0d6

  • memory/1992-8-0x0000000000500000-0x0000000000540000-memory.dmp

    Filesize

    256KB

  • memory/1992-2-0x0000000000500000-0x0000000000540000-memory.dmp

    Filesize

    256KB

  • memory/1992-4-0x0000000000560000-0x0000000000568000-memory.dmp

    Filesize

    32KB

  • memory/1992-5-0x0000000000570000-0x000000000057C000-memory.dmp

    Filesize

    48KB

  • memory/1992-6-0x00000000078E0000-0x0000000007982000-memory.dmp

    Filesize

    648KB

  • memory/1992-7-0x0000000074DE0000-0x00000000754CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1992-33-0x0000000074DE0000-0x00000000754CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1992-3-0x0000000000540000-0x0000000000558000-memory.dmp

    Filesize

    96KB

  • memory/1992-0-0x0000000000A20000-0x0000000000B1C000-memory.dmp

    Filesize

    1008KB

  • memory/1992-1-0x0000000074DE0000-0x00000000754CE000-memory.dmp

    Filesize

    6.9MB

  • memory/2248-44-0x0000000002660000-0x00000000026A0000-memory.dmp

    Filesize

    256KB

  • memory/2248-41-0x000000006E900000-0x000000006EEAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2248-46-0x000000006E900000-0x000000006EEAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2248-39-0x0000000002660000-0x00000000026A0000-memory.dmp

    Filesize

    256KB

  • memory/2248-37-0x000000006E900000-0x000000006EEAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2584-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2584-22-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2584-32-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2584-30-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2584-48-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2584-20-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2584-24-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2584-43-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2788-42-0x0000000002500000-0x0000000002540000-memory.dmp

    Filesize

    256KB

  • memory/2788-36-0x000000006E900000-0x000000006EEAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2788-45-0x0000000002500000-0x0000000002540000-memory.dmp

    Filesize

    256KB

  • memory/2788-40-0x000000006E900000-0x000000006EEAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2788-47-0x000000006E900000-0x000000006EEAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2788-38-0x0000000002500000-0x0000000002540000-memory.dmp

    Filesize

    256KB