Analysis
-
max time kernel
77s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2025, 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Confirmación de pago 6399272827973.exe
Resource
win7-20241010-en
2 signatures
150 seconds
General
-
Target
Confirmación de pago 6399272827973.exe
-
Size
103KB
-
MD5
6dfab0ee08d9db158c7398d91d3174a6
-
SHA1
d136f359f53be799c5a39d038e6389a12a4c8774
-
SHA256
5e2da094ff1653e89a849c5d3246446b39795b57f54c983b17452dd3efbc5ac9
-
SHA512
9ca1b19da2ebb3503540b892e75f73103394d54238bc94d2ee3e95679c1d798f06991588d9d610847066679b44d9febeadb3650626c5e01bf36f2cc9768eaabc
-
SSDEEP
1536:xamyCth9zKvhHnsLvH5fBhwPCD6VvJUrnc+bJoKZBdKFKKrZG8UKemHbJ/KZBVFR:x1DiZsLvZpeaOZJiVY4Vkmf
Malware Config
Extracted
Family
darkcloud
Credentials
Protocol: ftp- Host:
@StrFtpServer - Port:
21 - Username:
@StrFtpUser - Password:
@StrFtpPass
Signatures
-
Darkcloud family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2600 created 3368 2600 Confirmación de pago 6399272827973.exe 56 -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TargetSite.vbs Confirmación de pago 6399272827973.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2600 set thread context of 692 2600 Confirmación de pago 6399272827973.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Confirmación de pago 6399272827973.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2600 Confirmación de pago 6399272827973.exe 2600 Confirmación de pago 6399272827973.exe 2600 Confirmación de pago 6399272827973.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2600 Confirmación de pago 6399272827973.exe Token: SeDebugPrivilege 2600 Confirmación de pago 6399272827973.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 692 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2600 wrote to memory of 692 2600 Confirmación de pago 6399272827973.exe 94 PID 2600 wrote to memory of 692 2600 Confirmación de pago 6399272827973.exe 94 PID 2600 wrote to memory of 692 2600 Confirmación de pago 6399272827973.exe 94 PID 2600 wrote to memory of 692 2600 Confirmación de pago 6399272827973.exe 94 PID 2600 wrote to memory of 692 2600 Confirmación de pago 6399272827973.exe 94 PID 2600 wrote to memory of 692 2600 Confirmación de pago 6399272827973.exe 94 PID 2600 wrote to memory of 692 2600 Confirmación de pago 6399272827973.exe 94 PID 2600 wrote to memory of 692 2600 Confirmación de pago 6399272827973.exe 94
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\Confirmación de pago 6399272827973.exe"C:\Users\Admin\AppData\Local\Temp\Confirmación de pago 6399272827973.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:692
-