Analysis
- max time kernel
287s - max time network
266s - platform
windows10-2004_x64 - resource
win10v2004-20250211-en - resource tags
- submitted
17/02/2025, 12:52
General
- Target Request for Quote.exe
- Size 938KB
- Sample250217-p375caypgp
- SHA256 43170001d99fc7562988be92a4cca19caf875f59d63a15d46b32e33f2262ea54
Malware Config
Extracted
-
darkcloud
-
https://api.telegram.org/bot7750436831:AAExBaIgEdpzvewyD9nZGswvTgZ9nbP7qJA/sendMessage?chat_id=7895228061
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quote.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quote.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Request for Quote.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IDObfiKcyCG.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IDObfiKcyCG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1577.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkQzNUQwNzYtNDMwOC00NjY2LTlBNDktNTc2RDhDMEJBRjhBfSIgdXNlcmlkPSJ7Q0QxMDRDRUEtNjlBNy00MzAxLTlGQzctNEE2QzI4Nzk2QjdDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RkFFOUI4QUYtMEUyQi00RTk4LTlCQjItQ0IwRkUyNzNCODczfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mzk2MjIwMDU3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_fkxgizay.phn.ps1
tmp1577.tmp
memory/2268-25-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2268-31-0x0000000005EE0000-0x0000000006234000-memory.dmp
memory/2268-78-0x0000000007810000-0x000000000782A000-memory.dmp
memory/2268-19-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2268-37-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2268-80-0x0000000007A90000-0x0000000007B26000-memory.dmp
memory/2268-65-0x000000006F6F0000-0x000000006F73C000-memory.dmp
memory/2268-92-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2268-81-0x0000000007A10000-0x0000000007A21000-memory.dmp
memory/2268-82-0x0000000007A40000-0x0000000007A4E000-memory.dmp
memory/2268-85-0x0000000007B30000-0x0000000007B38000-memory.dmp
memory/2268-79-0x0000000007880000-0x000000000788A000-memory.dmp
memory/2292-9-0x0000000006860000-0x0000000006916000-memory.dmp
memory/2292-3-0x0000000004CA0000-0x0000000004D32000-memory.dmp
memory/2292-2-0x0000000005300000-0x00000000058A4000-memory.dmp
memory/2292-0-0x000000007453E000-0x000000007453F000-memory.dmp
memory/2292-10-0x000000000D2C0000-0x000000000D35C000-memory.dmp
memory/2292-53-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2292-1-0x0000000000210000-0x00000000002FC000-memory.dmp
memory/2292-8-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2292-7-0x000000007453E000-0x000000007453F000-memory.dmp
memory/2292-6-0x0000000005F20000-0x0000000005F3E000-memory.dmp
memory/2292-5-0x0000000004E50000-0x0000000004E5A000-memory.dmp
memory/2292-4-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2348-17-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2348-83-0x0000000007770000-0x0000000007784000-memory.dmp
memory/2348-55-0x000000006F6F0000-0x000000006F73C000-memory.dmp
memory/2348-66-0x00000000067C0000-0x00000000067DE000-memory.dmp
memory/2348-52-0x0000000006740000-0x000000000678C000-memory.dmp
memory/2348-54-0x0000000006830000-0x0000000006862000-memory.dmp
memory/2348-76-0x0000000007430000-0x00000000074D3000-memory.dmp
memory/2348-77-0x0000000007B70000-0x00000000081EA000-memory.dmp
memory/2348-15-0x00000000028E0000-0x0000000002916000-memory.dmp
memory/2348-16-0x0000000005450000-0x0000000005A78000-memory.dmp
memory/2348-21-0x0000000005360000-0x0000000005382000-memory.dmp
memory/2348-24-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2348-22-0x0000000005A80000-0x0000000005AE6000-memory.dmp
memory/2348-48-0x0000000006200000-0x000000000621E000-memory.dmp
memory/2348-84-0x0000000007870000-0x000000000788A000-memory.dmp
memory/2348-23-0x0000000005BA0000-0x0000000005C06000-memory.dmp
memory/2348-18-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2348-91-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/2872-38-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2872-36-0x0000000000400000-0x000000000046B000-memory.dmp