darkcloud | b67b8cd40460c4eaf0d05f0d097dcbce25444110aaa1e4af37440d206ad64b44

General

Target

PFI30SwiftCopy4-15-2025.exe
Size

762KB
MD5

1eec08f300b90b6e11ed91789fa9f152
SHA1

759f4d40f1eca57e5c53316bab8d30e2a6233757
SHA256

b67b8cd40460c4eaf0d05f0d097dcbce25444110aaa1e4af37440d206ad64b44
SHA512

e38bd2a8612af4539ecf8f386ec66d7ec3bd011f061cad8b3ed928b73ee67fe9ec65f119e2ca96ad95e23fbac00a4027aa04107656fc6f95fd97332a064b91e7
SSDEEP

12288:eG2LrZKuokM3I/2VycHnxuC/yB9sj1f90BT8LfZviKc6g6cFpyIPiHUXVBR0:eG2BKuFV/IyenxuC/yB92n0BT8LhvJ0Q

Score

10^/10

darkcloud guloader discovery downloader spyware stealer

Malware Config

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud
Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
5564	PFI30SwiftCopy4-15-2025.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	drive.google.com
22	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3992	PFI30SwiftCopy4-15-2025.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5564	PFI30SwiftCopy4-15-2025.exe
3992	PFI30SwiftCopy4-15-2025.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\rancorously.ini	PFI30SwiftCopy4-15-2025.exe
File opened for modification	C:\Windows\resources\0409\konfigureredes\peag.ini	PFI30SwiftCopy4-15-2025.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PFI30SwiftCopy4-15-2025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PFI30SwiftCopy4-15-2025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5116	taskkill.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5564	PFI30SwiftCopy4-15-2025.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3992	PFI30SwiftCopy4-15-2025.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3992	PFI30SwiftCopy4-15-2025.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 3992	5564	PFI30SwiftCopy4-15-2025.exe	91
PID 5564 wrote to memory of 3992	5564	PFI30SwiftCopy4-15-2025.exe	91
PID 5564 wrote to memory of 3992	5564	PFI30SwiftCopy4-15-2025.exe	91
PID 5564 wrote to memory of 3992	5564	PFI30SwiftCopy4-15-2025.exe	91
PID 3992 wrote to memory of 5116	3992	PFI30SwiftCopy4-15-2025.exe	95
PID 3992 wrote to memory of 5116	3992	PFI30SwiftCopy4-15-2025.exe	95
PID 3992 wrote to memory of 5116	3992	PFI30SwiftCopy4-15-2025.exe	95

C:\Users\Admin\AppData\Local\Temp\PFI30SwiftCopy4-15-2025.exe
"C:\Users\Admin\AppData\Local\Temp\PFI30SwiftCopy4-15-2025.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Users\Admin\AppData\Local\Temp\PFI30SwiftCopy4-15-2025.exe
  "C:\Users\Admin\AppData\Local\Temp\PFI30SwiftCopy4-15-2025.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso7764.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso7764.tmp\archostenosis.lnk

Filesize
1KB

MD5
a4c982fd18509b84309c96480d2eea91

SHA1
447fe33157ee212a421c2e5c04112b2fbb1c66f3

SHA256
89f66ba5b46737980ed6a29e59a9ba1dc4c1f4eb3c2bb2203ab2e37c91d777c9

SHA512
9ae12bb0ace9e403ba806e015c3c949d32d06d680521ae43212dd14a6e4d69660125169be60b646319a49282916dd0f14be26db7608d47e3d84f46fb4994fcb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ELDOIJJI-Admin.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ELDOIJJI-Admin.zip

Filesize
619B

MD5
19e597b4e9ac2cbc3d3ab269624240ef

SHA1
4fd3742053c00c2264cbecda78b60b45152d2322

SHA256
d23b41036120bc12819ad12bbba5251e4b8724b5b061b5725635c36a97cc7349

SHA512
f88969ecf937aa9ab8758ea1570fd3f7810d24259a3a33a3db0d741c05885c295fb838a6563f52fa46d683ec6a80239cb7c1491873c5bf64ac0518f83c47b688

Download Submit
C:\Windows\Resources\0409\rancorously.ini

Filesize
36B

MD5
9f26c215597c6d215332812cb96823de

SHA1
e38d33b223894281f48585d5ee4a3cfaa8a69b2f

SHA256
31ce0e20e2e3d6047008df8b1186381728ecbe32cbdb1d8528e966c6ff79a8be

SHA512
cf84962ab1e33b580ec7acbc848f944ca2da16a21743225d60dd759d4df09de93e05255e64de5edf1369aa7ad8647a3cc748ab7247b215939f3b46ca493eeb0a

Download Submit
memory/3992-381-0x00000000776C1000-0x00000000777E1000-memory.dmp

Filesize
1.1MB

Download
memory/3992-430-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-363-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-364-0x0000000077748000-0x0000000077749000-memory.dmp

Filesize
4KB

Download
memory/3992-365-0x0000000077765000-0x0000000077766000-memory.dmp

Filesize
4KB

Download
memory/3992-375-0x0000000001660000-0x0000000002948000-memory.dmp

Filesize
18.9MB

Download
memory/3992-376-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-378-0x0000000001660000-0x0000000002948000-memory.dmp

Filesize
18.9MB

Download
memory/3992-377-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-441-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-440-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-439-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-416-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-362-0x0000000001660000-0x0000000002948000-memory.dmp

Filesize
18.9MB

Download
memory/3992-431-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-432-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-433-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-434-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-435-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-436-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-437-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3992-438-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/5564-359-0x0000000003080000-0x0000000004368000-memory.dmp

Filesize
18.9MB

Download
memory/5564-360-0x00000000776C1000-0x00000000777E1000-memory.dmp

Filesize
1.1MB

Download
memory/5564-361-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing