darkcloud | 9ef94607fc86a367934d7bd636d9a92c6943e41a79f1defb622d8716f013bde8

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 16:31

Target

42352173769d2a4f3b7e4e10bb135092.exe
Size

1.2MB
MD5

42352173769d2a4f3b7e4e10bb135092
SHA1

87afa2afe4b2a5dda9d7684d79c5f2958d387ac8
SHA256

9ef94607fc86a367934d7bd636d9a92c6943e41a79f1defb622d8716f013bde8
SHA512

11708e5f16833f513f8ebb5e371dd9bbaaae03ec1d58ebc4dca369dbb4b9b472ad84f88e33b54ac80b64a3d42254a3d990d6584e5fe8b88596f19f2fd1ae82f5
SSDEEP

24576:yAHnh+eWsN3skA4RV1Hom2KXMmHa5vDa6jeukIWmxrQcBn5:1h+ZkldoPK8Ya5BeantQcX

Score

10^/10

darkcloud stealer

Family

darkcloud

Attributes

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Suspicious use of SetThreadContext 1 IoCs

Processes:

42352173769d2a4f3b7e4e10bb135092.exe

description pid process target process

PID 2164 set thread context of 2152 2164 42352173769d2a4f3b7e4e10bb135092.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

42352173769d2a4f3b7e4e10bb135092.exe

pid process

2164 42352173769d2a4f3b7e4e10bb135092.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

42352173769d2a4f3b7e4e10bb135092.exe

pid process

2164 42352173769d2a4f3b7e4e10bb135092.exe
2164 42352173769d2a4f3b7e4e10bb135092.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

42352173769d2a4f3b7e4e10bb135092.exe

pid process

2164 42352173769d2a4f3b7e4e10bb135092.exe
2164 42352173769d2a4f3b7e4e10bb135092.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

2152 svchost.exe

description	pid	process	target process
PID 2164 set thread context of 2152	2164	42352173769d2a4f3b7e4e10bb135092.exe	svchost.exe

pid	process
2164	42352173769d2a4f3b7e4e10bb135092.exe

pid	process
2164	42352173769d2a4f3b7e4e10bb135092.exe
2164	42352173769d2a4f3b7e4e10bb135092.exe

pid	process
2164	42352173769d2a4f3b7e4e10bb135092.exe
2164	42352173769d2a4f3b7e4e10bb135092.exe

pid	process
2152	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

42352173769d2a4f3b7e4e10bb135092.exe

description	pid	process	target process
PID 2164 wrote to memory of 2152	2164	42352173769d2a4f3b7e4e10bb135092.exe	svchost.exe
PID 2164 wrote to memory of 2152	2164	42352173769d2a4f3b7e4e10bb135092.exe	svchost.exe
PID 2164 wrote to memory of 2152	2164	42352173769d2a4f3b7e4e10bb135092.exe	svchost.exe
PID 2164 wrote to memory of 2152	2164	42352173769d2a4f3b7e4e10bb135092.exe	svchost.exe
PID 2164 wrote to memory of 2152	2164	42352173769d2a4f3b7e4e10bb135092.exe	svchost.exe

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\42352173769d2a4f3b7e4e10bb135092.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2152

memory/2152-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2152-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2152-16-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2164-10-0x0000000000320000-0x0000000000324000-memory.dmp

Filesize
16KB

Download