darkcloud | b67b8cd40460c4eaf0d05f0d097dcbce25444110aaa1e4af37440d206ad64b44

General

Target

PFI 30% Swift Copy 4-15-2025.exe
Size

762KB
MD5

1eec08f300b90b6e11ed91789fa9f152
SHA1

759f4d40f1eca57e5c53316bab8d30e2a6233757
SHA256

b67b8cd40460c4eaf0d05f0d097dcbce25444110aaa1e4af37440d206ad64b44
SHA512

e38bd2a8612af4539ecf8f386ec66d7ec3bd011f061cad8b3ed928b73ee67fe9ec65f119e2ca96ad95e23fbac00a4027aa04107656fc6f95fd97332a064b91e7
SSDEEP

12288:eG2LrZKuokM3I/2VycHnxuC/yB9sj1f90BT8LfZviKc6g6cFpyIPiHUXVBR0:eG2BKuFV/IyenxuC/yB92n0BT8LhvJ0Q

Score

10^/10

darkcloud guloader discovery downloader spyware stealer

Malware Config

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud
Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
5352	PFI 30% Swift Copy 4-15-2025.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1596	PFI 30% Swift Copy 4-15-2025.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5352	PFI 30% Swift Copy 4-15-2025.exe
1596	PFI 30% Swift Copy 4-15-2025.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\rancorously.ini	PFI 30% Swift Copy 4-15-2025.exe
File opened for modification	C:\Windows\resources\0409\konfigureredes\peag.ini	PFI 30% Swift Copy 4-15-2025.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PFI 30% Swift Copy 4-15-2025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PFI 30% Swift Copy 4-15-2025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3356	taskkill.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5352	PFI 30% Swift Copy 4-15-2025.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3356	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	PFI 30% Swift Copy 4-15-2025.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	PFI 30% Swift Copy 4-15-2025.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5352 wrote to memory of 1596	5352	PFI 30% Swift Copy 4-15-2025.exe	79
PID 5352 wrote to memory of 1596	5352	PFI 30% Swift Copy 4-15-2025.exe	79
PID 5352 wrote to memory of 1596	5352	PFI 30% Swift Copy 4-15-2025.exe	79
PID 5352 wrote to memory of 1596	5352	PFI 30% Swift Copy 4-15-2025.exe	79
PID 1596 wrote to memory of 3356	1596	PFI 30% Swift Copy 4-15-2025.exe	81
PID 1596 wrote to memory of 3356	1596	PFI 30% Swift Copy 4-15-2025.exe	81
PID 1596 wrote to memory of 3356	1596	PFI 30% Swift Copy 4-15-2025.exe	81

C:\Users\Admin\AppData\Local\Temp\PFI 30% Swift Copy 4-15-2025.exe
"C:\Users\Admin\AppData\Local\Temp\PFI 30% Swift Copy 4-15-2025.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Users\Admin\AppData\Local\Temp\PFI 30% Swift Copy 4-15-2025.exe
  "C:\Users\Admin\AppData\Local\Temp\PFI 30% Swift Copy 4-15-2025.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj447D.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj447D.tmp\archostenosis.lnk

Filesize
1KB

MD5
22d08267679ebc894d84187641788d81

SHA1
5c6b793f521ad11a1b5f0297f7cd66fbe7194a8e

SHA256
93265ae6d3b1f72477d6138d333522a4b35e7b114b5204222d166fb49c7dd0af

SHA512
062cef417d2fb89e76394f4bcd562f1134d3c23999bb646e51080d7393c0d5b79b86c814cfd508e6ec4c01b75c3f699e57fea5701e6d451e2f89510c18fbeba6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\UZEGIPAY-Admin.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\UZEGIPAY-Admin.zip

Filesize
628B

MD5
280cf60f72c4f691db927a1b6a37b1c1

SHA1
ff84bf4952779c162af3bf97a9d604309dcf1256

SHA256
e67fc726a73c87a9c63ef8f13f94a5f8155abf3d4c731b465b1999206126e65f

SHA512
ec9a1abb0c21d5028108851655491ab92a9e6af28dbf7e2382de3b2fa22dfac9e281b0a5746549ae129c06a804cae67a9e79b94cf75e3ff899d40a2458730582

Download Submit
C:\Windows\Resources\0409\rancorously.ini

Filesize
36B

MD5
9f26c215597c6d215332812cb96823de

SHA1
e38d33b223894281f48585d5ee4a3cfaa8a69b2f

SHA256
31ce0e20e2e3d6047008df8b1186381728ecbe32cbdb1d8528e966c6ff79a8be

SHA512
cf84962ab1e33b580ec7acbc848f944ca2da16a21743225d60dd759d4df09de93e05255e64de5edf1369aa7ad8647a3cc748ab7247b215939f3b46ca493eeb0a

Download Submit
memory/1596-390-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-416-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-364-0x00007FFD95200000-0x00007FFD95409000-memory.dmp

Filesize
2.0MB

Download
memory/1596-363-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-373-0x00007FFD95200000-0x00007FFD95409000-memory.dmp

Filesize
2.0MB

Download
memory/1596-374-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-375-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-376-0x0000000001720000-0x0000000002A08000-memory.dmp

Filesize
18.9MB

Download
memory/1596-379-0x00007FFD95200000-0x00007FFD95409000-memory.dmp

Filesize
2.0MB

Download
memory/1596-440-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-439-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-438-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-415-0x00007FFD95200000-0x00007FFD95409000-memory.dmp

Filesize
2.0MB

Download
memory/1596-362-0x0000000001720000-0x0000000002A08000-memory.dmp

Filesize
18.9MB

Download
memory/1596-430-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-431-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-432-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-433-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-434-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-435-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-436-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1596-437-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/5352-359-0x00000000032A0000-0x0000000004588000-memory.dmp

Filesize
18.9MB

Download
memory/5352-360-0x00007FFD95201000-0x00007FFD9532A000-memory.dmp

Filesize
1.2MB

Download
memory/5352-361-0x00007FFD95200000-0x00007FFD95409000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing