darkcloud | 9d0de04e246838edcff53feff522284ffac9de51f55804cf162d088c6aa6f4a7

Analysis

max time kernel
146s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Transferencia.exe
Size

1.0MB
MD5

fa20018130ae2d51f084e94f5d99bcc6
SHA1

cd080fba396b191094c2f1f40d60c5618df6442b
SHA256

9d0de04e246838edcff53feff522284ffac9de51f55804cf162d088c6aa6f4a7
SHA512

079b1b25cfcfc1ee05519abfba67e6c5c4ecd878b6077cc0f5c1c3f22d08343c484f11e794b4fe4c2af04ca5a5c2d314cda2dbcf7c202cd4cca9fa3d8d9e4347
SSDEEP

12288:uCWD4xZKxzWqvXHYXkX08C5KkpfqeH3cXiyQI7lMHAgfXm:QD4xZKx1XzJWBpfqeHMSw+5

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

https://api.telegram.org/bot7148308455:AAGrdlRzhjt8mx31-dFYXt4kvhbFnphSlSg/sendMessage?chat_id=6542615755

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 2692	2984	Transferencia.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	Transferencia.exe
2984	Transferencia.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	Transferencia.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2692	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28
PID 2984 wrote to memory of 2692	2984	Transferencia.exe	28

C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-10-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2692-19-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2692-18-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2692-9-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2692-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2984-4-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

Filesize
4KB

Download
memory/2984-7-0x00000000008F0000-0x00000000008F6000-memory.dmp

Filesize
24KB

Download
memory/2984-8-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-6-0x0000000002240000-0x000000000225A000-memory.dmp

Filesize
104KB

Download
memory/2984-5-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-0-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

Filesize
4KB

Download
memory/2984-3-0x0000000000670000-0x00000000006B4000-memory.dmp

Filesize
272KB

Download
memory/2984-17-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-2-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-1-0x00000000009B0000-0x0000000000ABC000-memory.dmp

Filesize
1.0MB

Download
memory/2984-22-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download