Analysis
- max time kernel
93s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
11/03/2025, 04:35
General
- Target b268d64c974f59357621dbc9daff9f033abf2703ee2e4cb971c09210dee7be5c.exe
- Size 312KB
- Sample250311-e73ejssvat
- SHA256 b268d64c974f59357621dbc9daff9f033abf2703ee2e4cb971c09210dee7be5c
Malware Config
Extracted
-
darkcloud
-
Protocol
ftp
-
Host
@StrFtpServer
-
Port
21
-
Username
@StrFtpUser
-
Password
@StrFtpPass
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b268d64c974f59357621dbc9daff9f033abf2703ee2e4cb971c09210dee7be5c.exe"C:\Users\Admin\AppData\Local\Temp\b268d64c974f59357621dbc9daff9f033abf2703ee2e4cb971c09210dee7be5c.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/436-1347-0x0000000000400000-0x0000000000459000-memory.dmp
memory/436-1359-0x0000000000400000-0x0000000000459000-memory.dmp
memory/3128-0-0x000000007489E000-0x000000007489F000-memory.dmp
memory/3128-1-0x0000000000390000-0x00000000003E4000-memory.dmp
memory/3128-2-0x0000000074890000-0x0000000075040000-memory.dmp
memory/3128-3-0x0000000004D80000-0x0000000004D86000-memory.dmp
memory/3128-4-0x00000000061A0000-0x00000000062D4000-memory.dmp
memory/3128-10-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-22-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-50-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-52-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-40-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-68-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-66-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-64-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-62-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-60-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-58-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-56-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-54-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-38-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-48-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-46-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-44-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-42-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-36-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-34-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-32-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-30-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-20-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-18-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-16-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-14-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-12-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-28-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-26-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-24-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-8-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-6-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-5-0x00000000061A0000-0x00000000062CE000-memory.dmp
memory/3128-1327-0x0000000074890000-0x0000000075040000-memory.dmp
memory/3128-1328-0x0000000006340000-0x00000000063CE000-memory.dmp
memory/3128-1329-0x0000000006430000-0x00000000064BA000-memory.dmp
memory/3128-1330-0x0000000006590000-0x00000000065DC000-memory.dmp
memory/3128-1331-0x0000000006E70000-0x0000000007414000-memory.dmp
memory/3128-1332-0x00000000068C0000-0x0000000006914000-memory.dmp
memory/3128-1338-0x000000007489E000-0x000000007489F000-memory.dmp
memory/3128-1340-0x0000000074890000-0x0000000075040000-memory.dmp
memory/3128-1337-0x0000000074890000-0x0000000075040000-memory.dmp
memory/3128-1345-0x0000000074890000-0x0000000075040000-memory.dmp
memory/3128-1342-0x0000000074890000-0x0000000075040000-memory.dmp
memory/3128-1358-0x0000000074890000-0x0000000075040000-memory.dmp