darkcloud | 5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe
Size

1.3MB
MD5

de296cc9a8a02468ab726641860fb8d3
SHA1

83da409a7a75c7f36955135b26cc9ff81a27d1e7
SHA256

5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c
SHA512

06fcc86bb3e7edffb492448034c41d627766be2fd9731a84938a2c5d415f106c54108cce927310ae45b0bcb05d46754ba216288ac380563e3816f46bb6a3757b
SSDEEP

24576:wu6J33O0c+JY5UZ+XC0kGso6FaD/kcOBp0jC96JAOubUgTAWY:6u0c++OCvkGs9FaD/ktH0jC96JANbbY

Score

10^/10

darkcloud discovery stealer

Malware Config

Extracted

Family

darkcloud

Credentials

Protocol: ftp
Host:
ftp.dorasanat.com.tr
Port:
21
Username:
[email protected]
Password:
K0BRhY6s,&aN

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 1592	1104	5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1104	5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1592	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1592	1104	5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe	87
PID 1104 wrote to memory of 1592	1104	5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe	87
PID 1104 wrote to memory of 1592	1104	5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe	87
PID 1104 wrote to memory of 1592	1104	5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe	87

C:\Users\Admin\AppData\Local\Temp\5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe
"C:\Users\Admin\AppData\Local\Temp\5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\5b2ae52cb8a7924d95ec9008dfcb8216468281fb5c7d07dcdf1a08b68f2bc65c.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-6-0x00000000011A0000-0x00000000015A0000-memory.dmp

Filesize
4.0MB

Download
memory/1592-7-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1592-9-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1592-12-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download