darkcloud | 80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b

General

Target

80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe
Size

774KB
MD5

c8da5cab3dd5285bcf8fbc5f77b1415a
SHA1

9132caf4f0c3030f044839c722c55da44b892ffc
SHA256

80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b
SHA512

292dc2ed09534add4f7c7057549c05007bf374a89dde107001adc3b943a4d7d3e3b5c90f8f09c46b311905c6a08120ed6b400df1cc56fcc4060ca860a733a7e0
SSDEEP

24576:kRFBUYxQiLg5N2Gzjne3qYHKKdskZtBCbEs:kRFjxQiLScGvnEqWs8zCn

Score

10^/10

darkcloud discovery execution spyware stealer upx

Malware Config

Extracted

Family

darkcloud

Credentials

Protocol: ftp
Host:
ftp.kashmirestore.com
Port:
21
Username:
[email protected]
Password:
c%P+6,(]YFvP

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
576	powershell.exe
2880	powershell.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000016c89-35.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2772	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2772-38-0x000000006FE70000-0x000000006FED9000-memory.dmp	upx
behavioral1/files/0x0007000000016c89-35.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe
1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe
1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe
576	powershell.exe
2880	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 576	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	31
PID 1736 wrote to memory of 576	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	31
PID 1736 wrote to memory of 576	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	31
PID 1736 wrote to memory of 576	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	31
PID 1736 wrote to memory of 2880	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	33
PID 1736 wrote to memory of 2880	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	33
PID 1736 wrote to memory of 2880	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	33
PID 1736 wrote to memory of 2880	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	33
PID 1736 wrote to memory of 3036	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	34
PID 1736 wrote to memory of 3036	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	34
PID 1736 wrote to memory of 3036	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	34
PID 1736 wrote to memory of 3036	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	34
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37
PID 1736 wrote to memory of 2772	1736	80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe	37

C:\Users\Admin\AppData\Local\Temp\80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe
"C:\Users\Admin\AppData\Local\Temp\80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sricWCFHDbf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sricWCFHDbf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFF65.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3036
- C:\Users\Admin\AppData\Local\Temp\80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe
  "C:\Users\Admin\AppData\Local\Temp\80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFF65.tmp

Filesize
1KB

MD5
2f5ed9c78cc08ff57f33e3515342bce7

SHA1
4e93503aa6c7c065fcc1295a17b2da0ead0b06fb

SHA256
4b86a833708d70a371259d509c6e2aa8cbadb30b81b9718b4dd99c17fd979e95

SHA512
dcadbabb8d8e2a08311049d81cfb7bfbdf3bb8d06642673d61d299eb41722c69cf72a56795983dddff53198fc21665bbe2c3c65c30a367eef4c2f3afd5e3e15f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
079caac2c45758a1b8ffbe1a9091ab2e

SHA1
56f9cf62f2a92a2156383cd01211d958ce97b572

SHA256
f68ab802ce741613b073c79e75a130b39164834ce8cc5cf653e1ba5135fe828c

SHA512
1e7bfe6dba0c5a40f4ef48f257730b3b4949bbd6177d8954a48ef5d2c179fa792e2651fb012b02cdbae4f1250d4e1f27f945afb9886ec7c13593bec80ed2962c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\KHBTHJFA-Admin\vbsqlite3.dll

Filesize
161KB

MD5
073a17b6cfb1112c6c838b2fba06a657

SHA1
a54bb22489eaa8c52eb3e512aee522320530b0be

SHA256
dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab

SHA512
5bc8307350bd8ba09fa9eedddc62f1dba65db62eb09ae64e0adff4dfad0937dbec5b621f294f5980bf77033faac3bfe200945c0280606915ee9a82d34a003b9e

Download Submit
memory/1736-4-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x0000000000940000-0x0000000000A06000-memory.dmp

Filesize
792KB

Download
memory/1736-5-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/1736-6-0x0000000004F00000-0x0000000004FA6000-memory.dmp

Filesize
664KB

Download
memory/1736-3-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/1736-2-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/1736-39-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/1736-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/2772-38-0x000000006FE70000-0x000000006FED9000-memory.dmp

Filesize
420KB

Download
memory/2772-29-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2772-28-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2772-23-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2772-21-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2772-19-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2772-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads