Analysis

  • max time kernel
    23s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06-02-2024 19:46

General

  • Target

    documents.bat.exe

  • Size

    877KB

  • MD5

    173aa6b5c260b3e19f1b979f054b02b0

  • SHA1

    9ea4da05677968a322acf4330699e76b31676130

  • SHA256

    0dd421edda69a829b7b9d025fd81f947085c0b3a54d9025312823a56c2b5df83

  • SHA512

    29415d7778eb7d1275815f1bcee0c3f0613f300df29172ab03d63c119491af6ced57c25c39ed27e010c0e7ce7be87de216bf2757480db9fd392b95c1f8282d51

  • SSDEEP

    24576:L/UAc8bshd1ixMpqvhnjqJR33ulonktC+FMIpSmUrSGG:L/U8bI1+MMv5YwloWCZU0m7

Score
10/10

Malware Config

Extracted

Family

darkcloud

Attributes

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\documents.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\documents.bat.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:2704
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:2840
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sTIDCEmUa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6DB1.tmp"
          2⤵
          • Creates scheduled task(s)
          PID:2796
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sTIDCEmUa.exe"
          2⤵
            PID:2452

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp6DB1.tmp

          Filesize

          1KB

          MD5

          b2d80f26b8e883149a8eb2dbcd30e655

          SHA1

          77f8795011a14ae1962d61a717f010ee8710b59b

          SHA256

          0fff3ff3a4f178d583c09bccaa02a75c62a264d973ea41e34c315d359a00ca55

          SHA512

          9e5aa51f1115c31a7cdb35c67a30d53e2cb169818c1a67bee9d86f7fc8024c3952c6192c15ebb2e124967ab0ddb05e1f7214df52b3e6bb21f3b92287d0a9821c

        • memory/2452-35-0x0000000002AF0000-0x0000000002B30000-memory.dmp

          Filesize

          256KB

        • memory/2452-36-0x000000006EAA0000-0x000000006F04B000-memory.dmp

          Filesize

          5.7MB

        • memory/2452-30-0x000000006EAA0000-0x000000006F04B000-memory.dmp

          Filesize

          5.7MB

        • memory/2452-31-0x000000006EAA0000-0x000000006F04B000-memory.dmp

          Filesize

          5.7MB

        • memory/2452-32-0x0000000002AF0000-0x0000000002B30000-memory.dmp

          Filesize

          256KB

        • memory/2452-34-0x0000000002AF0000-0x0000000002B30000-memory.dmp

          Filesize

          256KB

        • memory/2840-26-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/2840-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2840-24-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/2840-37-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/2840-15-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/2840-19-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/2840-33-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/2840-17-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/3020-6-0x0000000005C90000-0x0000000005D38000-memory.dmp

          Filesize

          672KB

        • memory/3020-3-0x00000000009A0000-0x00000000009BC000-memory.dmp

          Filesize

          112KB

        • memory/3020-2-0x0000000004B90000-0x0000000004BD0000-memory.dmp

          Filesize

          256KB

        • memory/3020-0-0x0000000000330000-0x0000000000412000-memory.dmp

          Filesize

          904KB

        • memory/3020-22-0x0000000004B90000-0x0000000004BD0000-memory.dmp

          Filesize

          256KB

        • memory/3020-5-0x0000000002020000-0x0000000002034000-memory.dmp

          Filesize

          80KB

        • memory/3020-4-0x0000000001ED0000-0x0000000001EDE000-memory.dmp

          Filesize

          56KB

        • memory/3020-7-0x0000000074670000-0x0000000074D5E000-memory.dmp

          Filesize

          6.9MB

        • memory/3020-1-0x0000000074670000-0x0000000074D5E000-memory.dmp

          Filesize

          6.9MB

        • memory/3020-28-0x0000000074670000-0x0000000074D5E000-memory.dmp

          Filesize

          6.9MB