darkcloud | 88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b

General

Target

88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
Size

847KB
MD5

5800ace6b81e2c2b8c9234fd725a61c1
SHA1

fb93c12d01d41a35c81422dd28cba8109842ff6e
SHA256

88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b
SHA512

e6161b5c927e49702260730ce03b74f76dcb8c4997aa3a8fcf633fdaf35c9db2cf8fbad5a307b18fe0bf19f77d789ffe99c9067e8ced21ce9833303ea9e8ea99
SSDEEP

12288:pA4DFzT37rQY/Hpf9PdsQ7scdcnYY97PuNlB/QRzIOslxN8w0sNFRzmvo/Pwetu+:KcpQUTP2cdcjj9RGCbYRKvo/PPPHvJ

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

Attributes

email_from
[email protected]
email_to
[email protected]

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

resource	yara_rule
behavioral1/memory/2468-21-0x0000000000400000-0x0000000000460000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2468-27-0x0000000000400000-0x0000000000460000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2468-30-0x0000000000400000-0x0000000000460000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2676-36-0x0000000002AF0000-0x0000000002B30000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/memory/2956-5-0x0000000000510000-0x000000000051C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/2468-27-0x0000000000400000-0x0000000000460000-memory.dmp	UPX
behavioral1/memory/2468-30-0x0000000000400000-0x0000000000460000-memory.dmp	UPX

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2956 set thread context of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
2528	powershell.exe
2676	powershell.exe
2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2528	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	28
PID 2956 wrote to memory of 2528	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	28
PID 2956 wrote to memory of 2528	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	28
PID 2956 wrote to memory of 2528	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	28
PID 2956 wrote to memory of 2676	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	30
PID 2956 wrote to memory of 2676	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	30
PID 2956 wrote to memory of 2676	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	30
PID 2956 wrote to memory of 2676	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	30
PID 2956 wrote to memory of 2576	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	32
PID 2956 wrote to memory of 2576	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	32
PID 2956 wrote to memory of 2576	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	32
PID 2956 wrote to memory of 2576	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	32
PID 2956 wrote to memory of 2592	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	34
PID 2956 wrote to memory of 2592	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	34
PID 2956 wrote to memory of 2592	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	34
PID 2956 wrote to memory of 2592	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	34
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35
PID 2956 wrote to memory of 2468	2956	88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe	35

C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
"C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GZfrOeGIjmbohc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GZfrOeGIjmbohc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp712A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
  "C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"
  2⤵
  PID:2592
- C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe
  "C:\Users\Admin\AppData\Local\Temp\88662dd7853cd4f04a590fc65bd5f431add70a7e9c645e0dbc7bd4d3708c491b.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp712A.tmp

Filesize
1KB

MD5
90cea72df83f82149b104df675362343

SHA1
1aa752582576792b3da95a62fe66225e51ced6f2

SHA256
8847148aaf0d583894b52dcd39544fc03985a850674f4ceea386fa25e83d0e8b

SHA512
9e2f4ab5719c01b666bcac7578b8dd1cdb6aac688e4764312b77a89af58bceb1b1192680fd5214c4c0c10ac439b1f9a15796c7a884d5de73ebf4891ecc1517b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
d5101e59800f9e6f401253705836eea5

SHA1
baf68241cd350a9178e73a34cf4b17d121052819

SHA256
d443e429f79f6284416cfc98049341db44b404da5c36ccee9f80cddcdc10ba9b

SHA512
495ab5150b39925f8a08ca5af12ba316825b90f3bd1d84930111c8224ddf39c4dc944d055f58e560fb0bd4b8d485fcb755536e4985194a932afa7551b7a1331e

Download Submit
memory/2468-27-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2468-30-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2468-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2468-19-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2468-20-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2468-21-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2528-39-0x0000000002CA0000-0x0000000002CE0000-memory.dmp

Filesize
256KB

Download
memory/2528-37-0x0000000002CA0000-0x0000000002CE0000-memory.dmp

Filesize
256KB

Download
memory/2528-34-0x000000006E5A0000-0x000000006EB4B000-memory.dmp

Filesize
5.7MB

Download
memory/2528-38-0x000000006E5A0000-0x000000006EB4B000-memory.dmp

Filesize
5.7MB

Download
memory/2528-40-0x000000006E5A0000-0x000000006EB4B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-35-0x000000006E5A0000-0x000000006EB4B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-33-0x000000006E5A0000-0x000000006EB4B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-36-0x0000000002AF0000-0x0000000002B30000-memory.dmp

Filesize
256KB

Download
memory/2956-18-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2956-29-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2956-6-0x0000000005940000-0x00000000059E8000-memory.dmp

Filesize
672KB

Download
memory/2956-0-0x0000000000840000-0x000000000091A000-memory.dmp

Filesize
872KB

Download
memory/2956-5-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/2956-4-0x0000000000500000-0x0000000000508000-memory.dmp

Filesize
32KB

Download
memory/2956-3-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/2956-2-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download
memory/2956-1-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads