Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/03/2024, 02:22
General
- Target 7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace.exe
- Size 2.5MB
- Sample240329-cty4vsfc2v
- SHA256 7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace
Malware Config
Extracted
-
darkcloud
-
https://api.telegram.org/bot6361371678:AAH7b9uIkhwP1TBt8t78VwxXD7LXjsOcbYk/sendMessage?chat_id=5527518337
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 17 IoCs
- Detects executables packed with Themida 18 IoCs
- Detects executables using Telegram Chat Bot 17 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- UPX dump on OEP (original entry point) 16 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 18 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace.exe"C:\Users\Admin\AppData\Local\Temp\7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-0-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-1-0x0000000077394000-0x0000000077396000-memory.dmp
memory/628-2-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-3-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-6-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-7-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-8-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-9-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-10-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-11-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-12-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-13-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-14-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-15-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-16-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-17-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-18-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-19-0x0000000000400000-0x0000000000A66000-memory.dmp
memory/628-20-0x0000000000400000-0x0000000000A66000-memory.dmp