Analysis

  • max time kernel
    135s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31-01-2024 15:04

General

  • Target

    payment receipts.exe

  • Size

    986KB

  • MD5

    cdcfa8aab8a4766ddb88df4635104d83

  • SHA1

    7ad43cc7224f694995e53325a581e659eabe2e16

  • SHA256

    0414ef0adb12bfe054d85f9196cee419bee6a7692187d83239bd5f8ee867c4c8

  • SHA512

    9948e0571bfd8a167ad456a7aa4380b7f73f0bc77475b827bb20303a5fe1bce03670900e275cec573c88df51cd42a2060012bba623c7358640af8e1209210acb

  • SSDEEP

    24576:FJRsQJVHvu3/mAUf45P3z55KTBmfswlibk:bWgHv0wq50TAfpEk

Score
10/10

Malware Config

Extracted

Family

darkcloud

Attributes

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\payment receipts.exe
    "C:\Users\Admin\AppData\Local\Temp\payment receipts.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\AppData\Local\Temp\payment receipts.exe
      "C:\Users\Admin\AppData\Local\Temp\payment receipts.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2704
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UbaskbOLQNa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp734C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2712
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UbaskbOLQNa.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2572
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\payment receipts.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp734C.tmp

    Filesize

    1KB

    MD5

    fc0a9e528c27d61b5320e9650643117c

    SHA1

    251d3acf0e5f8d653abf42c977e9f82ddb7da06d

    SHA256

    1b8b77e1399ce5611ba9ee527f83f5aada86c24df90761600ff4ff9e7aa2f3bf

    SHA512

    6ffc5ff51afb7b07a69596552d6ad9e23e7aa332ce7e23b375cc9da06cdef09c7a556eafbdeedc2e4e066a845eba5c732f2da18115da22dcb6088e5843260271

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    716e332a3292c2d12c4d3b3f3dfc1d20

    SHA1

    ea360a3e63f4480e1bb39c6d574af89cb7e0520d

    SHA256

    fa6564d3f570d3174456a66b10968f9cf2d0f808f256d5a7ad3ce802dca51841

    SHA512

    fcab6a27c6640859d6e6e47551b0cb223e7fd9f78a61d8968224753ff16ad1fdb07ea9221f8a5644fa036e1ca7ab62dd09f78e306900a3e21a8f796d319c0e93

  • memory/2152-35-0x00000000749F0000-0x00000000750DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2152-0-0x0000000000B90000-0x0000000000C8C000-memory.dmp

    Filesize

    1008KB

  • memory/2152-2-0x0000000000490000-0x00000000004D0000-memory.dmp

    Filesize

    256KB

  • memory/2152-3-0x00000000005A0000-0x00000000005B8000-memory.dmp

    Filesize

    96KB

  • memory/2152-4-0x0000000000940000-0x0000000000948000-memory.dmp

    Filesize

    32KB

  • memory/2152-5-0x0000000000950000-0x000000000095C000-memory.dmp

    Filesize

    48KB

  • memory/2152-6-0x0000000007870000-0x0000000007912000-memory.dmp

    Filesize

    648KB

  • memory/2152-7-0x00000000749F0000-0x00000000750DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2152-8-0x0000000000490000-0x00000000004D0000-memory.dmp

    Filesize

    256KB

  • memory/2152-1-0x00000000749F0000-0x00000000750DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2572-37-0x000000006E4F0000-0x000000006EA9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2572-46-0x0000000002940000-0x0000000002980000-memory.dmp

    Filesize

    256KB

  • memory/2572-49-0x000000006E4F0000-0x000000006EA9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2572-43-0x0000000002940000-0x0000000002980000-memory.dmp

    Filesize

    256KB

  • memory/2572-40-0x0000000002940000-0x0000000002980000-memory.dmp

    Filesize

    256KB

  • memory/2572-42-0x000000006E4F0000-0x000000006EA9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2624-48-0x000000006E4F0000-0x000000006EA9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2624-44-0x00000000029E0000-0x0000000002A20000-memory.dmp

    Filesize

    256KB

  • memory/2624-39-0x00000000029E0000-0x0000000002A20000-memory.dmp

    Filesize

    256KB

  • memory/2624-41-0x000000006E4F0000-0x000000006EA9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2624-38-0x000000006E4F0000-0x000000006EA9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2624-45-0x00000000029E0000-0x0000000002A20000-memory.dmp

    Filesize

    256KB

  • memory/2704-25-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2704-47-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2704-21-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2704-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2704-23-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2704-33-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2704-31-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2704-50-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB