Analysis
- max time kernel
100s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
09/10/2025, 14:17
General
- Target dcc9a87825692ae48ea938392908d1dcc6d1b002a7c8f89c348e5a2f8fee0e30.exe
- Size 963KB
- Sample251009-rl8ewseq7z
- SHA256 dcc9a87825692ae48ea938392908d1dcc6d1b002a7c8f89c348e5a2f8fee0e30
Malware Config
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcc9a87825692ae48ea938392908d1dcc6d1b002a7c8f89c348e5a2f8fee0e30.exe"C:\Users\Admin\AppData\Local\Temp\dcc9a87825692ae48ea938392908d1dcc6d1b002a7c8f89c348e5a2f8fee0e30.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dcc9a87825692ae48ea938392908d1dcc6d1b002a7c8f89c348e5a2f8fee0e30.exe"C:\Users\Admin\AppData\Local\Temp\dcc9a87825692ae48ea938392908d1dcc6d1b002a7c8f89c348e5a2f8fee0e30.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5684-0-0x0000000000280000-0x0000000000376000-memory.dmp
memory/5684-1-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/5684-2-0x0000000004D90000-0x0000000004E82000-memory.dmp
memory/5684-3-0x00000000054A0000-0x0000000005A46000-memory.dmp
memory/5684-4-0x0000000004FD0000-0x0000000005062000-memory.dmp
memory/5684-10-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-8-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-6-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-5-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-34-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-42-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-40-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-46-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-64-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-128-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-130-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-126-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-124-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-122-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-120-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-118-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-116-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-110-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-108-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-104-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-102-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-96-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-94-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-92-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-86-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-84-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-82-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-80-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-78-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-76-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-74-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-72-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-70-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-68-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-62-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-60-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-58-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-56-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-54-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-114-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-112-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-52-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-50-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-106-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-48-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-100-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-98-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-90-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-89-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-66-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-44-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-38-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-36-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-32-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-30-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-28-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-26-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-24-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-22-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-20-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-18-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-16-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-14-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-12-0x0000000004D90000-0x0000000004E7C000-memory.dmp
memory/5684-2041-0x00000000051C0000-0x0000000005218000-memory.dmp
memory/5684-2042-0x0000000005220000-0x000000000526C000-memory.dmp
memory/5684-2052-0x0000000004EE0000-0x0000000004EF0000-memory.dmp
memory/5764-2048-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5764-2051-0x0000000000400000-0x0000000000466000-memory.dmp