General

  • Target

    2584-30-0x0000000000400000-0x0000000000471000-memory.dmp

  • Size

    452KB

  • Sample

    250310-qp417swny8

  • MD5

    955d1fff318f0e3c097b53b0d928fa54

  • SHA1

    ecf9cae41bbf45610c8cc371721aa36ce4f55b8c

  • SHA256

    be38a493cdf68986cfbb58143f961881c871c9786731a1bb0f24402cd4469849

  • SHA512

    45cc3601805ff6defa5207b177d0b5b153915480c1b36571103ddd6fb0ad9695754a94d9be3cae32105486eb4ffaacd1ea4cf360932a87008afab653f97060e8

  • SSDEEP

    12288:jAjYKkJj6GmZUKO874ItG3yP9ukpCvpV5x:aYb6nZTFtG3Q9ukpCj5x

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot8052153515:AAEy1R0ssCqYRtfr5MLZ5lbcuC9K_RdIieY/sendMessage?chat_id=5022382431

Targets

    • Target

      2584-30-0x0000000000400000-0x0000000000471000-memory.dmp

    • Size

      452KB

    • MD5

      955d1fff318f0e3c097b53b0d928fa54

    • SHA1

      ecf9cae41bbf45610c8cc371721aa36ce4f55b8c

    • SHA256

      be38a493cdf68986cfbb58143f961881c871c9786731a1bb0f24402cd4469849

    • SHA512

      45cc3601805ff6defa5207b177d0b5b153915480c1b36571103ddd6fb0ad9695754a94d9be3cae32105486eb4ffaacd1ea4cf360932a87008afab653f97060e8

    • SSDEEP

      12288:jAjYKkJj6GmZUKO874ItG3yP9ukpCvpV5x:aYb6nZTFtG3Q9ukpCj5x

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks