darkcloud | 2049983c8bc3bc8bfd8eb95e01e56071ed1833b01a6923133d1238aa904f01d4

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iterms.pdf.exe
Size 921KB
Sample240416-jg5jfaed41
SHA256 2049983c8bc3bc8bfd8eb95e01e56071ed1833b01a6923133d1238aa904f01d4
MD5 9fe6dfcb679f1fb1c5a7c8c6269373ef
SHA1 0fa13c67f2642390e7aa402a1e3383429703572b
SHA512 bb33ec9b0e3579dad182b439ed8954d622124ba611eaeeb5bb93920a765c963da1de94da8895bf0e151ebef1380bf024606bff3fb9e2d4df7b14c8de2ff19e3c
SSDEEP 12288:9jbl5URBsle4E3NgwUaDTm4V4CxOaVhGDvnKYI6kQLGjouEu80Lx+wnMCwwrb2pp:1E3lUa/mQ4CxOASRKQLWsxVag8avn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

https://api.telegram.org/bot7070490418:AAFJ-COsGzz3b8scJZVCXnt58-J1srUH5DQ/sendMessage?chat_id=5590273095

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 4312	2408	iterms.pdf.exe	99

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2408	iterms.pdf.exe
2408	iterms.pdf.exe
2408	iterms.pdf.exe
2408	iterms.pdf.exe
2408	iterms.pdf.exe
2408	iterms.pdf.exe
2408	iterms.pdf.exe
2408	iterms.pdf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4312	iterms.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	iterms.pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4312	iterms.pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 860	2408	iterms.pdf.exe	95
PID 2408 wrote to memory of 860	2408	iterms.pdf.exe	95
PID 2408 wrote to memory of 860	2408	iterms.pdf.exe	95
PID 2408 wrote to memory of 4244	2408	iterms.pdf.exe	96
PID 2408 wrote to memory of 4244	2408	iterms.pdf.exe	96
PID 2408 wrote to memory of 4244	2408	iterms.pdf.exe	96
PID 2408 wrote to memory of 3976	2408	iterms.pdf.exe	97
PID 2408 wrote to memory of 3976	2408	iterms.pdf.exe	97
PID 2408 wrote to memory of 3976	2408	iterms.pdf.exe	97
PID 2408 wrote to memory of 3504	2408	iterms.pdf.exe	98
PID 2408 wrote to memory of 3504	2408	iterms.pdf.exe	98
PID 2408 wrote to memory of 3504	2408	iterms.pdf.exe	98
PID 2408 wrote to memory of 4312	2408	iterms.pdf.exe	99
PID 2408 wrote to memory of 4312	2408	iterms.pdf.exe	99
PID 2408 wrote to memory of 4312	2408	iterms.pdf.exe	99
PID 2408 wrote to memory of 4312	2408	iterms.pdf.exe	99
PID 2408 wrote to memory of 4312	2408	iterms.pdf.exe	99
PID 2408 wrote to memory of 4312	2408	iterms.pdf.exe	99
PID 2408 wrote to memory of 4312	2408	iterms.pdf.exe	99
PID 2408 wrote to memory of 4312	2408	iterms.pdf.exe	99

C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe"
  2⤵
  PID:860
- C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe"
  2⤵
  PID:4244
- C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe"
  2⤵
  PID:3976
- C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe"
  2⤵
  PID:3504
- C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\iterms.pdf.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-8-0x0000000005300000-0x0000000005308000-memory.dmp

Download

memory/2408-9-0x0000000005580000-0x000000000558C000-memory.dmp

Download

memory/2408-2-0x00000000056C0000-0x0000000005C64000-memory.dmp

Download

memory/2408-3-0x00000000051B0000-0x0000000005242000-memory.dmp

Download

memory/2408-4-0x0000000005310000-0x0000000005320000-memory.dmp

Download

memory/2408-5-0x0000000005160000-0x000000000516A000-memory.dmp

Download

memory/2408-1-0x0000000074710000-0x0000000074EC0000-memory.dmp

Download

memory/2408-6-0x0000000006470000-0x0000000006548000-memory.dmp

Download

memory/2408-0-0x0000000000680000-0x000000000076C000-memory.dmp

Download

memory/2408-7-0x00000000052C0000-0x00000000052D2000-memory.dmp

Download

memory/2408-10-0x0000000006580000-0x000000000663E000-memory.dmp

Download

memory/2408-11-0x0000000008C90000-0x0000000008D2C000-memory.dmp

Download

memory/2408-17-0x0000000074710000-0x0000000074EC0000-memory.dmp

Download

memory/4312-15-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4312-12-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4312-19-0x0000000000400000-0x0000000000475000-memory.dmp

Download