darkcloud | 20f5a6ea5d82805e2351a6c238113d09f536833ca5216bc933bf8a0b107f6e7e

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2024, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order.exe
Size 1.2MB
Sample240322-mr3dlsdd2t
SHA256 ed8e5351ed8a26c9ab5d66009110e292b10a00044a5a6d914b0b06b833079900
MD5 bd1f796e6516ae12edb278fad9d7cdf5
SHA1 8b8b12626be3c5ea14642d89f036196984c3595a
SHA512 13a484eb6c9e09f8d82745f3c616fc5fc314d29940cd34690850ec48f0a31e3f960ced750fcbc9f40bf9eafe021796d9994cfa40c32d98717bb13ede5bc12035
SSDEEP 24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaSx5rLUiTSEsmJMTM8eAy5:Dh+ZkldoPK8YaScTmCIf1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

Attributes

email_from
[email protected]
email_to
[email protected]

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3284 set thread context of 5016	3284	New Order.exe	99

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3284	New Order.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3284	New Order.exe
3284	New Order.exe
3284	New Order.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3284	New Order.exe
3284	New Order.exe
3284	New Order.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 5016	3284	New Order.exe	99
PID 3284 wrote to memory of 5016	3284	New Order.exe	99
PID 3284 wrote to memory of 5016	3284	New Order.exe	99
PID 3284 wrote to memory of 5016	3284	New Order.exe	99

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3284-10-0x0000000003700000-0x0000000003704000-memory.dmp

Download

memory/5016-11-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/5016-13-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/5016-16-0x0000000000400000-0x0000000000468000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads