Analysis
- max time kernel
149s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
16/04/2024, 08:32
General
- Target 88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
- Size 847KB
- Sample240416-ke9aaadd94
- SHA256 88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b
Malware Config
Extracted
-
darkcloud
- email_from
- email_to
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GZfrOeGIjmbohc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GZfrOeGIjmbohc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA18.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_i35bfnvu.epj.ps1
tmpBA18.tmp
memory/944-56-0x0000000006C30000-0x0000000006C62000-memory.dmp
memory/944-17-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/944-88-0x0000000007B90000-0x0000000007BA1000-memory.dmp
memory/944-87-0x0000000007C10000-0x0000000007CA6000-memory.dmp
memory/944-86-0x0000000007A00000-0x0000000007A0A000-memory.dmp
memory/944-84-0x0000000007FD0000-0x000000000864A000-memory.dmp
memory/944-83-0x0000000005170000-0x0000000005180000-memory.dmp
memory/944-15-0x00000000050A0000-0x00000000050D6000-memory.dmp
memory/944-33-0x0000000006050000-0x00000000063A4000-memory.dmp
memory/944-89-0x0000000007BC0000-0x0000000007BCE000-memory.dmp
memory/944-59-0x0000000072EE0000-0x0000000072F2C000-memory.dmp
memory/944-18-0x0000000005170000-0x0000000005180000-memory.dmp
memory/944-21-0x0000000005170000-0x0000000005180000-memory.dmp
memory/944-58-0x000000007EF80000-0x000000007EF90000-memory.dmp
memory/944-20-0x00000000057B0000-0x0000000005DD8000-memory.dmp
memory/944-55-0x0000000006700000-0x000000000674C000-memory.dmp
memory/944-90-0x0000000007BD0000-0x0000000007BE4000-memory.dmp
memory/944-54-0x0000000006670000-0x000000000668E000-memory.dmp
memory/944-25-0x0000000005690000-0x00000000056B2000-memory.dmp
memory/944-99-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/2160-16-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/2160-4-0x0000000005AF0000-0x0000000005B00000-memory.dmp
memory/2160-10-0x0000000006F10000-0x0000000006FAC000-memory.dmp
memory/2160-51-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/2160-8-0x0000000006CF0000-0x0000000006CFC000-memory.dmp
memory/2160-0-0x0000000000EE0000-0x0000000000FBA000-memory.dmp
memory/2160-2-0x0000000006020000-0x00000000065C4000-memory.dmp
memory/2160-3-0x0000000005990000-0x0000000005A22000-memory.dmp
memory/2160-1-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/2160-9-0x0000000006D60000-0x0000000006E08000-memory.dmp
memory/2160-5-0x0000000005A70000-0x0000000005A7A000-memory.dmp
memory/2160-6-0x0000000005E50000-0x0000000005E62000-memory.dmp
memory/2160-19-0x0000000005AF0000-0x0000000005B00000-memory.dmp
memory/2160-7-0x0000000006CE0000-0x0000000006CE8000-memory.dmp
memory/2356-46-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2356-50-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2356-100-0x0000000000400000-0x0000000000460000-memory.dmp
memory/4444-70-0x0000000007050000-0x000000000706E000-memory.dmp
memory/4444-85-0x00000000071B0000-0x00000000071CA000-memory.dmp
memory/4444-82-0x00000000025B0000-0x00000000025C0000-memory.dmp
memory/4444-57-0x0000000072EE0000-0x0000000072F2C000-memory.dmp
memory/4444-80-0x00000000025B0000-0x00000000025C0000-memory.dmp
memory/4444-81-0x0000000007070000-0x0000000007113000-memory.dmp
memory/4444-69-0x000000007F050000-0x000000007F060000-memory.dmp
memory/4444-91-0x00000000074F0000-0x000000000750A000-memory.dmp
memory/4444-92-0x00000000074D0000-0x00000000074D8000-memory.dmp
memory/4444-22-0x00000000025B0000-0x00000000025C0000-memory.dmp
memory/4444-98-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/4444-23-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/4444-26-0x0000000005790000-0x00000000057F6000-memory.dmp
memory/4444-27-0x0000000005800000-0x0000000005866000-memory.dmp