Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2025, 07:02

General

  • Target

    4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe

  • Size

    845KB

  • MD5

    1c952627db9f89d810c16e45f7364f5f

  • SHA1

    75087303e05cbe848e3dd2d709542aaa8f5d98c0

  • SHA256

    4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf

  • SHA512

    1ff1cd3b0d685e2fa07714bcddf594507928a116fc33a27615d00859e19e6e4c1dcf0a27c75c52505d12dd086ad8f6cf8f564e56bbd8408cc57d94300112bac4

  • SSDEEP

    24576:yr++eYJ/eRnjnielBiPI/TS1EmUJrJABUGG9Y/assxUfA:y++eYYpnFviw/TS6AI9tsZY

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot7922909971:AAESR5mvezMqr8iz6psLIehHVuWpWpAUuaI/sendMessage?chat_id=7518399906

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Darkcloud family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
    "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4948
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OjzZfu.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2012
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OjzZfu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4BAA.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4252
    • C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
      "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
      2⤵
        PID:1216
      • C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
        "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
        2⤵
          PID:2488
        • C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
          "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:3944

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        d6a8b68195d75a12548e57f9f4e42b8c

        SHA1

        bb58d2ff8212b99b6d7896d016c6b166f5a2a67c

        SHA256

        4d4f1f68fa79fed495e36142aea32a0e5d2c62c7687df8f57e9d891763776876

        SHA512

        dea3ea2fe55c2abb8229d8ba89c167b1c0d83b683ce30043d697f19e9edd675ee8e0ae51e50f8f2302ab25876777083c328a375b4f578f391280774b36510acf

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2qljlfik.usi.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmp4BAA.tmp

        Filesize

        1KB

        MD5

        e2a5de162c4343c2d39b4e13fdf42a38

        SHA1

        288233948a2ce3e833c1ddf6874eb32bd07c98f2

        SHA256

        21de388580a5ad49d0b9d4fe05e0045bda76770fae386220e4e6a7ad787fb2fe

        SHA512

        73728778a3815a0fc2ae4ed9ad3a6f34962b8a4657f9eb8e337a61b0aa9e9477a3b95baf670293cea12fbee2d8f7c2d177e6480a7d332121b4a079895d3c5012

      • memory/2012-77-0x0000000007530000-0x000000000754A000-memory.dmp

        Filesize

        104KB

      • memory/2012-54-0x0000000070040000-0x000000007008C000-memory.dmp

        Filesize

        304KB

      • memory/2012-82-0x0000000007770000-0x0000000007784000-memory.dmp

        Filesize

        80KB

      • memory/2012-81-0x0000000007760000-0x000000000776E000-memory.dmp

        Filesize

        56KB

      • memory/2012-80-0x0000000007730000-0x0000000007741000-memory.dmp

        Filesize

        68KB

      • memory/2012-79-0x00000000077B0000-0x0000000007846000-memory.dmp

        Filesize

        600KB

      • memory/2012-92-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/2012-76-0x0000000007B80000-0x00000000081FA000-memory.dmp

        Filesize

        6.5MB

      • memory/2012-53-0x0000000007190000-0x00000000071C2000-memory.dmp

        Filesize

        200KB

      • memory/2012-83-0x0000000007870000-0x000000000788A000-memory.dmp

        Filesize

        104KB

      • memory/2012-65-0x00000000071D0000-0x00000000071EE000-memory.dmp

        Filesize

        120KB

      • memory/2012-19-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/2012-84-0x0000000007850000-0x0000000007858000-memory.dmp

        Filesize

        32KB

      • memory/2012-20-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/2012-25-0x0000000005B10000-0x0000000005B76000-memory.dmp

        Filesize

        408KB

      • memory/2012-23-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/3944-46-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/3944-45-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/4948-40-0x00000000061A0000-0x00000000064F4000-memory.dmp

        Filesize

        3.3MB

      • memory/4948-78-0x0000000007A50000-0x0000000007A5A000-memory.dmp

        Filesize

        40KB

      • memory/4948-22-0x0000000005E20000-0x0000000005E42000-memory.dmp

        Filesize

        136KB

      • memory/4948-24-0x0000000005FC0000-0x0000000006026000-memory.dmp

        Filesize

        408KB

      • memory/4948-91-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/4948-52-0x0000000006C60000-0x0000000006CAC000-memory.dmp

        Filesize

        304KB

      • memory/4948-50-0x00000000066B0000-0x00000000066CE000-memory.dmp

        Filesize

        120KB

      • memory/4948-17-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/4948-60-0x0000000070040000-0x000000007008C000-memory.dmp

        Filesize

        304KB

      • memory/4948-18-0x0000000005770000-0x0000000005D98000-memory.dmp

        Filesize

        6.2MB

      • memory/4948-16-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

        Filesize

        216KB

      • memory/4948-75-0x00000000076E0000-0x0000000007783000-memory.dmp

        Filesize

        652KB

      • memory/4948-15-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/5080-10-0x0000000008C20000-0x0000000008CBC000-memory.dmp

        Filesize

        624KB

      • memory/5080-0-0x000000007526E000-0x000000007526F000-memory.dmp

        Filesize

        4KB

      • memory/5080-9-0x00000000064D0000-0x0000000006588000-memory.dmp

        Filesize

        736KB

      • memory/5080-8-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/5080-7-0x000000007526E000-0x000000007526F000-memory.dmp

        Filesize

        4KB

      • memory/5080-6-0x0000000005740000-0x0000000005750000-memory.dmp

        Filesize

        64KB

      • memory/5080-5-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/5080-4-0x0000000005150000-0x000000000515A000-memory.dmp

        Filesize

        40KB

      • memory/5080-3-0x0000000005090000-0x0000000005122000-memory.dmp

        Filesize

        584KB

      • memory/5080-2-0x0000000005770000-0x0000000005D14000-memory.dmp

        Filesize

        5.6MB

      • memory/5080-51-0x0000000075260000-0x0000000075A10000-memory.dmp

        Filesize

        7.7MB

      • memory/5080-1-0x0000000000600000-0x00000000006D8000-memory.dmp

        Filesize

        864KB