Analysis
- max time kernel
101s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
- submitted
15/03/2025, 02:02
General
- Target 05f9ab531ad28b30e3b464ab5c1800890c97c746873b13f5c55a2cdfffb58528.exe
- Size 717KB
- Sample250315-cf8fdawn15
- SHA256 05f9ab531ad28b30e3b464ab5c1800890c97c746873b13f5c55a2cdfffb58528
Malware Config
Extracted
-
darkcloud
-
Protocol
ftp
-
Host
ftp.loreali.com
-
Port
21
-
Username
loreali
-
Password
BOSSMMC@2024
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Blocklisted process makes network request 3 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05f9ab531ad28b30e3b464ab5c1800890c97c746873b13f5c55a2cdfffb58528.exe"C:\Users\Admin\AppData\Local\Temp\05f9ab531ad28b30e3b464ab5c1800890c97c746873b13f5c55a2cdfffb58528.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Yern=GC -Raw 'C:\Users\Admin\AppData\Local\resider\actinidiaceae\Sendetidernes.fru';$Haul=$Yern.SubString(53177,3);.$Haul($Yern)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_01t5fqf0.sls.ps1
Firevrelseslejligheds.unf
Sendetidernes.fru
memory/212-55-0x0000000007920000-0x000000000792A000-memory.dmp
memory/212-37-0x0000000007C10000-0x00000000081B4000-memory.dmp
memory/212-19-0x0000000005520000-0x0000000005542000-memory.dmp
memory/212-21-0x0000000005D70000-0x0000000005DD6000-memory.dmp
memory/212-20-0x00000000056C0000-0x0000000005726000-memory.dmp
memory/212-17-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-27-0x0000000005DE0000-0x0000000006134000-memory.dmp
memory/212-32-0x00000000063B0000-0x00000000063CE000-memory.dmp
memory/212-33-0x00000000063E0000-0x000000000642C000-memory.dmp
memory/212-34-0x0000000007370000-0x0000000007406000-memory.dmp
memory/212-35-0x00000000068A0000-0x00000000068BA000-memory.dmp
memory/212-36-0x00000000068F0000-0x0000000006912000-memory.dmp
memory/212-57-0x0000000007AF0000-0x0000000007AFE000-memory.dmp
memory/212-16-0x0000000005740000-0x0000000005D68000-memory.dmp
memory/212-39-0x0000000008840000-0x0000000008EBA000-memory.dmp
memory/212-40-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-41-0x00000000077B0000-0x00000000077E2000-memory.dmp
memory/212-42-0x000000006F960000-0x000000006F9AC000-memory.dmp
memory/212-52-0x0000000007790000-0x00000000077AE000-memory.dmp
memory/212-53-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-54-0x0000000007800000-0x00000000078A3000-memory.dmp
memory/212-14-0x00000000734DE000-0x00000000734DF000-memory.dmp
memory/212-18-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-56-0x0000000007AA0000-0x0000000007AB1000-memory.dmp
memory/212-65-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-59-0x0000000007B40000-0x0000000007B5A000-memory.dmp
memory/212-60-0x0000000007B30000-0x0000000007B38000-memory.dmp
memory/212-61-0x0000000007B90000-0x0000000007BBA000-memory.dmp
memory/212-62-0x0000000007BC0000-0x0000000007BE4000-memory.dmp
memory/212-64-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-63-0x00000000734DE000-0x00000000734DF000-memory.dmp
memory/212-58-0x0000000007B00000-0x0000000007B14000-memory.dmp
memory/212-66-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-68-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-15-0x0000000002DE0000-0x0000000002E16000-memory.dmp
memory/212-70-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-71-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-72-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-73-0x0000000008EC0000-0x000000000DD18000-memory.dmp
memory/212-74-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-75-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/212-77-0x00000000734D0000-0x0000000073C80000-memory.dmp
memory/4024-78-0x0000000076F21000-0x0000000077041000-memory.dmp
memory/4024-79-0x0000000076FA8000-0x0000000076FA9000-memory.dmp
memory/4024-80-0x0000000076F21000-0x0000000077041000-memory.dmp
memory/4024-87-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/4024-88-0x0000000000400000-0x00000000005E4000-memory.dmp