Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20250313-en - resource tags
- submitted
14/03/2025, 00:00
General
- Target tmpgrglbjxb.exe
- Size 706KB
- Sample250314-aaak2swvcv
- SHA256 97a824c3107a8d65a3f935e427d07bdf8d593da8cb5e4ff22f542fc2dc04ff8e
Malware Config
Extracted
-
darkcloud
-
Protocol
ftp
-
Host
@StrFtpServer
-
Port
21
-
Username
@StrFtpUser
-
Password
@StrFtpPass
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Adds Run key to start application 2 TTPs 1 IoCs
- Blocklisted process makes network request 4 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpgrglbjxb.exe"C:\Users\Admin\AppData\Local\Temp\tmpgrglbjxb.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Opsaetnings=GC -Raw 'C:\Users\Admin\AppData\Local\resider\actinidiaceae\Favosites.Sen';$Exophoric=$Opsaetnings.SubString(56950,3);.$Exophoric($Opsaetnings)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ynwpp5y3.ugz.ps1
Favosites.Sen
Mimikerens97.Out195
memory/2000-109-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-107-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-111-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-110-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-113-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-114-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-108-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-112-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-106-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-105-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-91-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-88-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-81-0x0000000077131000-0x0000000077251000-memory.dmp
memory/2000-115-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/2000-80-0x00000000771B8000-0x00000000771B9000-memory.dmp
memory/2000-79-0x0000000077131000-0x0000000077251000-memory.dmp
memory/5508-61-0x0000000007850000-0x000000000787A000-memory.dmp
memory/5508-72-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-53-0x0000000006F40000-0x0000000006F5E000-memory.dmp
memory/5508-52-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-54-0x0000000006F70000-0x0000000007013000-memory.dmp
memory/5508-55-0x0000000007090000-0x000000000709A000-memory.dmp
memory/5508-56-0x00000000070B0000-0x00000000070C1000-memory.dmp
memory/5508-57-0x0000000007100000-0x000000000710E000-memory.dmp
memory/5508-58-0x0000000007110000-0x0000000007124000-memory.dmp
memory/5508-59-0x0000000007840000-0x000000000785A000-memory.dmp
memory/5508-60-0x0000000007140000-0x0000000007148000-memory.dmp
memory/5508-14-0x00000000736EE000-0x00000000736EF000-memory.dmp
memory/5508-62-0x0000000007880000-0x00000000078A4000-memory.dmp
memory/5508-64-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-63-0x00000000736EE000-0x00000000736EF000-memory.dmp
memory/5508-65-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-67-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-68-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-42-0x000000006FB70000-0x000000006FBBC000-memory.dmp
memory/5508-70-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-71-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-41-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-73-0x0000000008400000-0x000000000D1D8000-memory.dmp
memory/5508-74-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-75-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-76-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-78-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-40-0x0000000006F00000-0x0000000006F32000-memory.dmp
memory/5508-39-0x0000000007D80000-0x00000000083FA000-memory.dmp
memory/5508-37-0x0000000007150000-0x00000000076F4000-memory.dmp
memory/5508-36-0x0000000006080000-0x00000000060A2000-memory.dmp
memory/5508-35-0x0000000006030000-0x000000000604A000-memory.dmp
memory/5508-34-0x0000000006AA0000-0x0000000006B36000-memory.dmp
memory/5508-33-0x0000000005BA0000-0x0000000005BEC000-memory.dmp
memory/5508-32-0x0000000005AF0000-0x0000000005B0E000-memory.dmp
memory/5508-31-0x0000000005610000-0x0000000005964000-memory.dmp
memory/5508-21-0x00000000054A0000-0x0000000005506000-memory.dmp
memory/5508-20-0x0000000005430000-0x0000000005496000-memory.dmp
memory/5508-19-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-18-0x0000000004B30000-0x0000000004B52000-memory.dmp
memory/5508-16-0x00000000736E0000-0x0000000073E90000-memory.dmp
memory/5508-17-0x0000000004D90000-0x00000000053B8000-memory.dmp
memory/5508-15-0x0000000000BD0000-0x0000000000C06000-memory.dmp