darkcloud | 40eef915ba2a07c79245cf756df19409e4ec1aedb063d7a2c7bc9e587d4951d8

General

Target
PURCHASE ORDER NO_76896.exe
Size 1.1MB
Sample250905-webjss1mt5
SHA256 40eef915ba2a07c79245cf756df19409e4ec1aedb063d7a2c7bc9e587d4951d8
MD5 3a0539fd461f442c506afdd3749425cc
SHA1 53988eddee0019e93ef77a08a6b3bb4fea299568
SHA512 c17dcad738828cfb9d8b0631b651aa2390e0db6794a5532d8ce69582283467435dfc3651baefb4b1e26e5f2779cab1bb5d41767ffe5f0063f9607ad7914a29cf
SSDEEP 24576:o5EmXFtKaL4/oFe5T9yyXYfP1ijXdaGx+aDJ50z:oPVt/LZeJbInQRaGYa15
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery darkcloud persistence stealer

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot8365645575:AAEQT_N09lDjEsrpZTodZtDLEcItjKCUl6U/sendMessage?chat_id=6683518699

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud

Executes dropped EXE 1 IoCs

pid	Process
5860	flaker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\fluorated = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\flaker.exe"	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 4032	1664	PURCHASE ORDER NO_76896.exe	79

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PURCHASE ORDER NO_76896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4032	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1664	PURCHASE ORDER NO_76896.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1664	PURCHASE ORDER NO_76896.exe
1664	PURCHASE ORDER NO_76896.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1664	PURCHASE ORDER NO_76896.exe
1664	PURCHASE ORDER NO_76896.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4032	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4032	1664	PURCHASE ORDER NO_76896.exe	79
PID 1664 wrote to memory of 4032	1664	PURCHASE ORDER NO_76896.exe	79
PID 1664 wrote to memory of 4032	1664	PURCHASE ORDER NO_76896.exe	79
PID 1664 wrote to memory of 4032	1664	PURCHASE ORDER NO_76896.exe	79
PID 1432 wrote to memory of 5860	1432	cmd.exe	82
PID 1432 wrote to memory of 5860	1432	cmd.exe	82
PID 1432 wrote to memory of 5860	1432	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER NO_76896.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER NO_76896.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER NO_76896.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\flaker.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\flaker.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\flaker.exe
  2⤵
  - Executes dropped EXE
  PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LoginData

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\LLNSKQSM-Admin\LoginData
Size 56KB
SHA256 ce41f2a3255df2099ae8eea9364bd28c6fd6a56c8ca3290bd274944d16d9e6bf
MD5 0e2c60740cafa19c5158f4aa41a5d4e7
SHA1 f01d0f359e407fed424c30919ed64b77508b3024
SHA512 e367b88f1d984f84b9b4a8fa4002ede1afad0d375f9374636250f17e64445a60d1b99fe23a0b314c4b2bd5fd27fe5b87fa4079a84b4497629f238afd8436afe2
SSDEEP 96:qUfXG38t8KLPeymORCGr25bn8MouB6w9f/rGSEPONy:qUu0RCGr2V7Iw9fFN
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebData

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\LLNSKQSM-Admin\WebData
Size 228KB
SHA256 257947aba31142bab41ca56915c2ef843c2a156c527dee5d1a07e1224e380aed
MD5 8ce704458e632d243a023357eec3702f
SHA1 b4857c6a1e277776b8a08c243917eeae5470aa56
SHA512 a96d4aded8fd5ce2cfeeaba2bc69a399006bc723e1aa0777989648b2fe8caa7b6d421744c2bcd52b633d0e2d41b951df2cbc91ac64054c7b8cb63f887b496449
SSDEEP 192:DC3fT8aRJQnGqqrgenLfUK3NDivIz6DoNCPaWaVIdssXVydue2g2C0:e3fQuJQnPqrgWLfUK3hivmY4Cvp68C
MD5 SHA1 SHA512 SSDEEP

Submit Download

flaker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\flaker.exe
Size 47KB
SHA256 f56fe75ca483fbe899281d59e94eb40575efc24cc6c09e499ca084986eea13e9
MD5 03c502d5d9f66850493f66fbac233105
SHA1 18bfc01e4704786ea9c2e1c990f624c404392ebe
SHA512 dfd3431c24bf9c04cd7054c87cf3fd18fe14fd595a25211fd2cefa002ae7b4da5db081afda110f4014a6a9dac6fec96468b86c3a194fc251346e431b0d565e60
SSDEEP 768:FLNsis2Ng6h4ZmPxQM0m8aBW7AVPyNEmH/ZTDuuaARs1PTh61:cis2Ng6h4mjR8iiCAZfXa2MPTs1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1664-12-0x0000000001830000-0x0000000001C30000-memory.dmp

Download

memory/4032-13-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4032-15-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/4032-37-0x0000000000400000-0x000000000044B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads