darkcloud | 39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2

General

Target

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
Size

4.8MB
MD5

51ecdc2470c3d74fd02ae636ede8ea50
SHA1

699c18118bf2181ad2a4107c018380bde7bf959d
SHA256

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2
SHA512

0ed1942659cb5a942d7831bb2edc25a5a350743766aec97236311adf9d35bb58aa9a51ad1f0d2ff52b81eb28d04c715c9de4d00d9d2f5296ad6e1223838a6614
SSDEEP

98304:A9+lCU89BjJMZoVbn9+lCU89BjJMZoVbJ9+lCU89BjJMZoVb:XlCUIBjslCUIBjalCUIBj

Score

10^/10

darkcloud xred backdoor discovery persistence stealer

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot7791323838:AAE3VAK5D-6z6zW2W49g82tPlNqRUAWW6SI/sendMessage?chat_id=6595599138

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 7 IoCs

Processes:

._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exeSynaptics.exeSynaptics.exeSynaptics.exeSynaptics.exeSynaptics.exeSynaptics.exe

pid	process
2704	._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
1056	Synaptics.exe
1696	Synaptics.exe
3016	Synaptics.exe
1988	Synaptics.exe
2392	Synaptics.exe
2720	Synaptics.exe

Loads dropped DLL 3 IoCs

Processes:

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

pid	process
2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

description	pid	process	target process
PID 2804 set thread context of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exeSynaptics.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exeSynaptics.exe

pid	process
2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe
1056	Synaptics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exeSynaptics.exe

description	pid	process
Token: SeDebugPrivilege	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
Token: SeDebugPrivilege	1056	Synaptics.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

pid process

2704 ._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exeSynaptics.exe

description	pid	process	target process
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2804 wrote to memory of 2868	2804	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2868 wrote to memory of 2704	2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2868 wrote to memory of 2704	2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2868 wrote to memory of 2704	2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2868 wrote to memory of 2704	2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
PID 2868 wrote to memory of 1056	2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	Synaptics.exe
PID 2868 wrote to memory of 1056	2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	Synaptics.exe
PID 2868 wrote to memory of 1056	2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	Synaptics.exe
PID 2868 wrote to memory of 1056	2868	39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe	Synaptics.exe
PID 1056 wrote to memory of 1696	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 1696	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 1696	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 1696	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 3016	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 3016	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 3016	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 3016	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 1988	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 1988	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 1988	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 1988	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 2392	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 2392	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 2392	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 2392	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 2720	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 2720	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 2720	1056	Synaptics.exe	Synaptics.exe
PID 1056 wrote to memory of 2720	1056	Synaptics.exe	Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
"C:\Users\Admin\AppData\Local\Temp\39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
  "C:\Users\Admin\AppData\Local\Temp\39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2704
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe"
      4⤵
      Executes dropped EXE
      PID:1696
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe"
      4⤵
      Executes dropped EXE
      PID:3016
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe"
      4⤵
      Executes dropped EXE
      PID:1988
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe"
      4⤵
      Executes dropped EXE
      PID:2392
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe"
      4⤵
      Executes dropped EXE
      PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
4.8MB

MD5
51ecdc2470c3d74fd02ae636ede8ea50

SHA1
699c18118bf2181ad2a4107c018380bde7bf959d

SHA256
39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2

SHA512
0ed1942659cb5a942d7831bb2edc25a5a350743766aec97236311adf9d35bb58aa9a51ad1f0d2ff52b81eb28d04c715c9de4d00d9d2f5296ad6e1223838a6614

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_39b71735c29ae5e9ec286aae7d645109d241a76007c23db531878d5daad2f9a2N.exe

Filesize
412KB

MD5
e01ba441b60c3b99317668c96dc4d261

SHA1
891e0746e95d64c33267620da07c4c60170cc28e

SHA256
fdda0e6a51c2bb59a620f073f6d0d15389884a6a8dcb7dbc39a4d0a723f76e49

SHA512
d79555112e4af42e53ed332d4fff17b8afc40ebde18e7c6131ed6b721472321f1e2500c3878b3969f68a1f1a898575189d5af0c632c1ce3d74ded6820abd6f7c

Download Submit
memory/1056-57-0x0000000000220000-0x00000000006FE000-memory.dmp

Filesize
4.9MB

Download
memory/2804-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

Filesize
4KB

Download
memory/2804-1-0x0000000000FE0000-0x00000000014BE000-memory.dmp

Filesize
4.9MB

Download
memory/2804-2-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2804-3-0x0000000000760000-0x000000000077E000-memory.dmp

Filesize
120KB

Download
memory/2804-4-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

Filesize
4KB

Download
memory/2804-5-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2804-6-0x000000000AC80000-0x000000000ADEC000-memory.dmp

Filesize
1.4MB

Download
memory/2804-30-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-19-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-23-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-17-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-15-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-11-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-10-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-29-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2868-28-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2868-13-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-25-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-24-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-56-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/2868-7-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads