darkcloud | 20bd8539534e2dd5704b9c3bad34d64bbba4c96532dc19c522fd77edbbda3b0d

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/03/2026, 12:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260316_389277392372,PDF.js
Size 2.5MB
Sample260316-n9wjfset41
SHA256 20bd8539534e2dd5704b9c3bad34d64bbba4c96532dc19c522fd77edbbda3b0d
MD5 e75e80321d6f509d2bfa7cc978fee130
SHA1 88ce2d4d83470b93c73e708a7ee77a62332e3549
SHA512 ffa492a955d1d896c61a937d151ddab7bf1748d9013fbb033ff59cf4e1f6dc4a70e4c28d817c92387292b20a7d09970249faf70737c2d31d4a7dfa6a754d9b49
SSDEEP 24576:pm0RYtqP5H2jxMOylY509eT3SdgQAoBhItOghsDSDFB/+41QFimNPqr5pIau1Jpa:pZe09c3ggVoBWO/DSJBg8ZTnuH6
TLSH
T11FC58E19388439F04BBC7C62A4152D4C3B6503F261CA753EEB61EA469EF7F268C5D8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darkcloud stealer

Malware Config

Extracted

Family

darkcloud

Attributes

email_from
[email protected]
email_to
[email protected]
host_password
Tarz?8181
host_server
webmail.tarzdenizcilik.com

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud
Darkcloud family
darkcloud

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1776	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 1408	1776	powershell.exe	101

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aspnet_compiler.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4644	taskkill.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	4644	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1408	Aspnet_compiler.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1776	2500	wscript.exe	86
PID 1776 wrote to memory of 2988	1776	powershell.exe	88
PID 1776 wrote to memory of 4824	1776	powershell.exe	89
PID 1776 wrote to memory of 3860	1776	powershell.exe	90
PID 1776 wrote to memory of 3252	1776	powershell.exe	91
PID 1776 wrote to memory of 2128	1776	powershell.exe	92
PID 1776 wrote to memory of 1408	1776	powershell.exe	101
PID 1776 wrote to memory of 1408	1776	powershell.exe	101
PID 1776 wrote to memory of 1408	1776	powershell.exe	101
PID 1776 wrote to memory of 1408	1776	powershell.exe	101
PID 1776 wrote to memory of 1408	1776	powershell.exe	101
PID 2500 wrote to memory of 4644	2500	wscript.exe	110

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\IMG_20260316_389277392372,PDF.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_rdQKnL7sthqk_1773662782979.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
    3⤵
    PID:2988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
    3⤵
    PID:4824
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
    3⤵
    PID:3860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
    3⤵
    PID:3252
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
    3⤵
    PID:2128
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1408
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_rdQKnL7sthqk_1773662782979.ps1

Path C:\Temp\ps_rdQKnL7sthqk_1773662782979.ps1
Size 1.8MB
SHA256 d5259494100d00a47b6692eef2d653036be7f3babc79afc159f87dbdde2dcc62
MD5 9f5bce4dff442a2abc85cf211a08e6ba
SHA1 d481d36531c849d4349ad03e212bdb461aae83b8
SHA512 0f6e34cfb35d0cf89d7681df25bd5feb18345a9be59250af3d75993940afcd8ec646f9677dfcae4dda47dd4cd0c62299075ca6abb1aa033036bd8d577d24aea0
SSDEEP 49152:lLkO8/QzyTva+Tvbda+esxLAmt8uA59ALAopYDvxWsKWGxh5I5xY9O0t:0
TLSH
T1D0957D2B2E5EF780E7070919772751E19E6E83902226DF6CBAF61BAFC1404D917EE434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3oc5gits.kwr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3oc5gits.kwr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1408-14-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1408-30-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1408-16-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1776-13-0x000001F9405C0000-0x000001F9405C8000-memory.dmp

Download

memory/1776-1-0x000001F940260000-0x000001F940270000-memory.dmp

Download

memory/1776-12-0x000001F9405B0000-0x000001F9405BC000-memory.dmp

Download

memory/1776-11-0x000001F940260000-0x000001F940270000-memory.dmp

Download

memory/1776-28-0x000001F927C80000-0x000001F927C8C000-memory.dmp

Download

memory/1776-29-0x000001F940260000-0x000001F940270000-memory.dmp

Download

memory/1776-7-0x000001F940230000-0x000001F940252000-memory.dmp

Download

memory/2500-27-0x000001A6CD740000-0x000001A6CD74C000-memory.dmp

Download

memory/4644-40-0x00000255F3230000-0x00000255F32FD000-memory.dmp

Download