darkcloud | 31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
Size 1.2MB
Sample260508-p14n5scy3l
SHA256 31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba
MD5 317914132b548c5cfc43966656f86236
SHA1 22919df58b44b2357645bfe44ee06c4f56634b42
SHA512 9416b4b399a3f49a5180c80cae2e068de7c5c2ca58ed6317a8c97743bb0251e318b0328b112df3ab245a46245c1495b52ef91a263a5703d380a6bab55e9298aa
SSDEEP 24576:qO8+v9N5aNtbXLJQlQ/Sh2hOsjVHbQL1VRTozLqCH:jvOtb9Y2caRbQL1V4+C
TLSH
T133451224AA3DDA42D8F487F80DA1E37613B49D8DE511C2138EFEFDE77865B0A2409653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darkcloud spyware stealer

Malware Config

Extracted

Family

darkcloud

Attributes

email_from
[email protected]
email_to
[email protected]
host_password
81Ers2378498!!
host_server
ersanet.com.tr

Signatures

Family: DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hjhKWvNVYVLQqA.lnk	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe

Executes dropped EXE 2 IoCs

pid	Process
3444	chrome.exe
3520	Google-Chrome.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4724-6-0x0000000008110000-0x0000000008126000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4724 set thread context of 4932	4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe	79

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\Google-Chrome.exe	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2688	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
1836	powershell.exe
1836	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4932	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	1836	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4932	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
3444	chrome.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4932	4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe	79
PID 4724 wrote to memory of 4932	4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe	79
PID 4724 wrote to memory of 4932	4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe	79
PID 4724 wrote to memory of 4932	4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe	79
PID 4724 wrote to memory of 4932	4724	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe	79
PID 4932 wrote to memory of 2688	4932	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe	80
PID 4932 wrote to memory of 3444	4932	31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe	85
PID 3444 wrote to memory of 3520	3444	chrome.exe	86

C:\Users\Admin\AppData\Local\Temp\31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
"C:\Users\Admin\AppData\Local\Temp\31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe
  "C:\Users\Admin\AppData\Local\Temp\31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BEKPASEB-Admin\chrome.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BEKPASEB-Admin\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Program Files\Google\Chrome\Application\Google-Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Google-Chrome.exe"
      4⤵
      Executes dropped EXE
      PID:3520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Google-Chrome.exe

Path C:\Program Files\Google\Chrome\Application\Google-Chrome.exe
Size 8KB
SHA256 0f78885c06cc8b07829847f8b9b948f4b3048cb42e4e00dbee8fb684424664ca
MD5 5824ebcaa504b9b5831a385eae95652d
SHA1 cf88ab7ab6884f3442e88fce505a0a709042c3cf
SHA512 c14253e9d95936346b62d1d219d38f8d90e406a4ea028fbf7c228df6b603e94b8f9274685d237a183ec76a053c2b2d0c4ded37e37ecde11e7c6f90632d573dc4
SSDEEP 96:+wF/uJuBIDVB24MjLbPLODVd3KNGiGfW8ONdIJkbmprioOx:TFuB25jL7Kn36cfGIkOio
TLSH
T18902B781DA84BD98E56B42BB59730B2DB7E4B57507809AFF81789C1C173EAC12432E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ep0jzx4d.hnw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ep0jzx4d.hnw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BEKPASEB-Admin\chrome.exe
Size 28KB
SHA256 d890c39dc1644a16f99142a73766db35676b386d6319c6b0f82e8c88ea821a85
MD5 5dcbed1fae79d50bd94d6d9c7e692f10
SHA1 6d9f5f9b48b5995283330e19611f57103174bb81
SHA512 2ab6550a383f2a1e76e1cbf22a9fbf4119f6e84af077c03febbb80ffc488e52f13557a9f746eb3374dbecd08bb8733f2a3b2335e81200c61ae889ad0574f992d
SSDEEP 384:/Thf9gflG91T01ZFmDeIDFx57KnrfUOi:/NilkV84DeKFx57Yr5i
TLSH
T1ECD2F712E6D8A974F26B46B31C338B6C66F6FC3006809E6F687C7E1D0E3558258B1B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_decrypt.zip

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BEKPASEB-Admin\chrome_decrypt.zip
Size 8KB
SHA256 1f5fca2a2ff6581857dfe856692f3146e2d4b40a61c33ae7661f40f2367516ba
MD5 0941fa17bfaf8906d3070cfd44ba401c
SHA1 f763201afa240ccbe8306ce122898800bb6ec71a
SHA512 d34c4cc3d815fafb2f92b96f1019b316ee904bae587d9e9708b81da97aa6dfe3d6712c7d52b18fe06308afc4de9d60e25c1a2847b3988b9b4d18af78e22e6b09
SSDEEP 192:0Td1A5Slr8oOm6L0RZClfNcqNEEYz+KR+kyYOJ+cOPmoDP:Md1A5Slr8T7IjYxNZYzR3O0j7
TLSH
T13C02A0B45347E76ABD6A6C31116D6DC29D33909EEB17F5B11E553974A9FC8C0030ADC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1836-86-0x00000245ADC70000-0x00000245ADC82000-memory.dmp

Download

memory/1836-38-0x00000245C65B0000-0x00000245C65F6000-memory.dmp

Download

memory/1836-37-0x00000245C6120000-0x00000245C6142000-memory.dmp

Download

memory/4724-5-0x0000000005560000-0x00000000055FC000-memory.dmp

Download

memory/4724-6-0x0000000008110000-0x0000000008126000-memory.dmp

Download

memory/4724-9-0x0000000008180000-0x0000000008286000-memory.dmp

Download

memory/4724-1-0x00000000057A0000-0x0000000005D46000-memory.dmp

Download

memory/4724-19-0x0000000005070000-0x00000000051BD000-memory.dmp

Download

memory/4724-2-0x00000000052E0000-0x0000000005372000-memory.dmp

Download

memory/4724-8-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/4724-7-0x0000000005070000-0x00000000051BD000-memory.dmp

Download

memory/4724-0-0x00000000005C0000-0x00000000006F0000-memory.dmp

Download

memory/4724-4-0x00000000053A0000-0x00000000053AA000-memory.dmp

Download

memory/4724-3-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/4932-18-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4932-85-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4932-15-0x0000000000400000-0x0000000000471000-memory.dmp

Download