Analysis
-
max time kernel
141s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10/03/2025, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe
Resource
win7-20240729-en
General
-
Target
c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe
-
Size
311KB
-
MD5
9d987a16f2c44ba82fae968214b863be
-
SHA1
961c8eeab295364d45ff3ad68c4ad77f592c8226
-
SHA256
c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d
-
SHA512
709830c8c732997e08c0e0b81322ef95bc3a25825ec1d9e86af2d9ac6b289bcdbd5d3e446277dd8049625ca694404e4eac95e37fcbd0a5c4ee8c548edad83807
-
SSDEEP
6144:cN8gWgVacaPSVWhDvVbx18IcUSxlI9Tj+5REQZ87wq6tecuoLi9MNj:IWgUblv82SxQUm7X6tecuIi9MNj
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot6107929879:AAHV6JwXs7rcYzMGLe3_opR5_gdKAC16Ye4/sendMessage?chat_id=6311012313
Signatures
-
Darkcloud family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2328 set thread context of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caspol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2392 caspol.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2228 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 30 PID 2328 wrote to memory of 2228 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 30 PID 2328 wrote to memory of 2228 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 30 PID 2328 wrote to memory of 2228 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 30 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31 PID 2328 wrote to memory of 2392 2328 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe"C:\Users\Admin\AppData\Local\Temp\c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"2⤵PID:2228
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2392
-