Analysis
-
max time kernel
142s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2025, 11:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
sars.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
sars.exe
-
Size
1.3MB
-
MD5
de296cc9a8a02468ab726641860fb8d3
-
SHA1
83da409a7a75c7f36955135b26cc9ff81a27d1e7
-
SHA256
5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c
-
SHA512
06fcc86bb3e7edffb492448034c41d627766be2fd9731a84938a2c5d415f106c54108cce927310ae45b0bcb05d46754ba216288ac380563e3816f46bb6a3757b
-
SSDEEP
24576:wu6J33O0c+JY5UZ+XC0kGso6FaD/kcOBp0jC96JAOubUgTAWY:6u0c++OCvkGs9FaD/ktH0jC96JANbbY
Malware Config
Extracted
Family
darkcloud
Credentials
Protocol: ftp- Host:
ftp.dorasanat.com.tr - Port:
21 - Username:
[email protected] - Password:
K0BRhY6s,&aN
Signatures
-
Darkcloud family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3472 set thread context of 116 3472 sars.exe 86 -
Program crash 1 IoCs
pid pid_target Process procid_target 4212 3472 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sars.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3472 sars.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 116 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3472 wrote to memory of 116 3472 sars.exe 86 PID 3472 wrote to memory of 116 3472 sars.exe 86 PID 3472 wrote to memory of 116 3472 sars.exe 86 PID 3472 wrote to memory of 116 3472 sars.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\sars.exe"C:\Users\Admin\AppData\Local\Temp\sars.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\sars.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 6042⤵
- Program crash
PID:4212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3472 -ip 34721⤵PID:4820