darkcloud | b67b8cd40460c4eaf0d05f0d097dcbce25444110aaa1e4af37440d206ad64b44

General

Target

PFI30SwiftCopy4-15-2025.exe
Size

762KB
MD5

1eec08f300b90b6e11ed91789fa9f152
SHA1

759f4d40f1eca57e5c53316bab8d30e2a6233757
SHA256

b67b8cd40460c4eaf0d05f0d097dcbce25444110aaa1e4af37440d206ad64b44
SHA512

e38bd2a8612af4539ecf8f386ec66d7ec3bd011f061cad8b3ed928b73ee67fe9ec65f119e2ca96ad95e23fbac00a4027aa04107656fc6f95fd97332a064b91e7
SSDEEP

12288:eG2LrZKuokM3I/2VycHnxuC/yB9sj1f90BT8LfZviKc6g6cFpyIPiHUXVBR0:eG2BKuFV/IyenxuC/yB92n0BT8LhvJ0Q

Score

10^/10

darkcloud guloader discovery downloader spyware stealer

Malware Config

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud
Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
3388	PFI30SwiftCopy4-15-2025.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	drive.google.com
14	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1180	PFI30SwiftCopy4-15-2025.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3388	PFI30SwiftCopy4-15-2025.exe
1180	PFI30SwiftCopy4-15-2025.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\rancorously.ini	PFI30SwiftCopy4-15-2025.exe
File opened for modification	C:\Windows\resources\0409\konfigureredes\peag.ini	PFI30SwiftCopy4-15-2025.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PFI30SwiftCopy4-15-2025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PFI30SwiftCopy4-15-2025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2732	taskkill.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3388	PFI30SwiftCopy4-15-2025.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1180	PFI30SwiftCopy4-15-2025.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1180	PFI30SwiftCopy4-15-2025.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1180	3388	PFI30SwiftCopy4-15-2025.exe	84
PID 3388 wrote to memory of 1180	3388	PFI30SwiftCopy4-15-2025.exe	84
PID 3388 wrote to memory of 1180	3388	PFI30SwiftCopy4-15-2025.exe	84
PID 3388 wrote to memory of 1180	3388	PFI30SwiftCopy4-15-2025.exe	84
PID 1180 wrote to memory of 2732	1180	PFI30SwiftCopy4-15-2025.exe	86
PID 1180 wrote to memory of 2732	1180	PFI30SwiftCopy4-15-2025.exe	86
PID 1180 wrote to memory of 2732	1180	PFI30SwiftCopy4-15-2025.exe	86

C:\Users\Admin\AppData\Local\Temp\PFI30SwiftCopy4-15-2025.exe
"C:\Users\Admin\AppData\Local\Temp\PFI30SwiftCopy4-15-2025.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\PFI30SwiftCopy4-15-2025.exe
  "C:\Users\Admin\AppData\Local\Temp\PFI30SwiftCopy4-15-2025.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz6B3F.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3F.tmp\archostenosis.lnk

Filesize
1KB

MD5
60158943ca99805d9a52e64e396a3c09

SHA1
e654abc2586245df6d74efab9d07241dafd762ef

SHA256
7ebdbf7353dd358e3c780ae244b79ff5eecad743a00e65daac6afde883aa81f8

SHA512
f95ec28605cfe512db111e3ea908c4578a4fb02f7c64febc538de7bd470a53bc50cf87203231057b158eebc58786dd89af941429395ed1c378d0816e917d9351

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\LSXLBRIO-Admin.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Windows\Resources\0409\rancorously.ini

Filesize
36B

MD5
9f26c215597c6d215332812cb96823de

SHA1
e38d33b223894281f48585d5ee4a3cfaa8a69b2f

SHA256
31ce0e20e2e3d6047008df8b1186381728ecbe32cbdb1d8528e966c6ff79a8be

SHA512
cf84962ab1e33b580ec7acbc848f944ca2da16a21743225d60dd759d4df09de93e05255e64de5edf1369aa7ad8647a3cc748ab7247b215939f3b46ca493eeb0a

Download Submit
memory/1180-393-0x00007FFFB2780000-0x00007FFFB2989000-memory.dmp

Filesize
2.0MB

Download
memory/1180-401-0x00007FFFB2780000-0x00007FFFB2989000-memory.dmp

Filesize
2.0MB

Download
memory/1180-362-0x0000000001720000-0x0000000002A08000-memory.dmp

Filesize
18.9MB

Download
memory/1180-363-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-364-0x00007FFFB2780000-0x00007FFFB2989000-memory.dmp

Filesize
2.0MB

Download
memory/1180-371-0x00007FFFB2780000-0x00007FFFB2989000-memory.dmp

Filesize
2.0MB

Download
memory/1180-372-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-373-0x0000000001720000-0x0000000002A08000-memory.dmp

Filesize
18.9MB

Download
memory/1180-376-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-377-0x00007FFFB2780000-0x00007FFFB2989000-memory.dmp

Filesize
2.0MB

Download
memory/1180-425-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-424-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-399-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-423-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-414-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-415-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-416-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-417-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-418-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-419-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-420-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-421-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/1180-422-0x0000000000400000-0x0000000001717000-memory.dmp

Filesize
19.1MB

Download
memory/3388-361-0x00007FFFB2780000-0x00007FFFB2989000-memory.dmp

Filesize
2.0MB

Download
memory/3388-359-0x00000000032D0000-0x00000000045B8000-memory.dmp

Filesize
18.9MB

Download
memory/3388-360-0x00007FFFB2781000-0x00007FFFB28AA000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing