darkcloud | a05e47692520185c1d3b5b0bb72b6a4b954064d2e28af22c5dad24fb2b924743

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AW_PO.js
Size 4.8MB
Sample260730-pgwt7a1vfs
SHA256 a05e47692520185c1d3b5b0bb72b6a4b954064d2e28af22c5dad24fb2b924743
MD5 eb68387c3cddac70afe315bbb18d85c4
SHA1 38dbd2460eb0886bb773cba229ec479a0b7d6dec
SHA512 2504330f06865baa830f7f8c518717fa04fd41d47ec5b9b02e7879712f70c24dacd8938841f0beabfa03e794fcf5cff5e70f98285965fa3917708e1b86a43fc7
SSDEEP 98304:MCzJ0S1W2+Hy8y1ZNe7x5SF2OqlADbxja2RRN8/hn6aDkVc1rJSd:30g7+S81VLOqlIbVau8JPScHSd
TLSH
T1C036178142585DF5A1EDE70CE87AEA6017891143068ADF2E3379818BB71BEC7734C6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution darkcloud persistence stealer

Malware Config

Extracted

Family

darkcloud

Version

Signatures

Family: DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3456	PKPEKVVUSPVNJTHP.PIF

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
1048	cmd.exe
436	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	3456	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PKPEKVVUSPVNJTHP.PIF
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2316	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	whoami.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3456	4872	wscript.exe	87
PID 3456 wrote to memory of 4908	3456	PKPEKVVUSPVNJTHP.PIF	89
PID 4908 wrote to memory of 4460	4908	cmd.exe	90
PID 3456 wrote to memory of 1048	3456	PKPEKVVUSPVNJTHP.PIF	91
PID 1048 wrote to memory of 3544	1048	cmd.exe	92
PID 3456 wrote to memory of 436	3456	PKPEKVVUSPVNJTHP.PIF	93
PID 436 wrote to memory of 2316	436	cmd.exe	94

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AW_PO.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.PIF
  "C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.PIF" C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.ttf
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c whoami
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\SysWOW64\whoami.exe
      whoami
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /query /tn "PKPEKVVUSPVNJTHP" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /query /tn "PKPEKVVUSPVNJTHP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 15 /tn "PKPEKVVUSPVNJTHP" /tr "cmd /c \"C:\Users\Admin\Documents\PHTJNVPSUVVKEPKP.url\"" /ru "ocpzfhhi\admin" /f /it
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 15 /tn "PKPEKVVUSPVNJTHP" /tr "cmd /c \"C:\Users\Admin\Documents\PHTJNVPSUVVKEPKP.url\"" /ru "ocpzfhhi\admin" /f /it
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 320
    3⤵
    - Program crash
    PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3456 -ip 3456
1⤵
PID:628

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PKPEKVVUSPVNJTHP.PIF

Path C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.PIF
Size 499KB
SHA256 d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49
MD5 7675b38aabebc8427171447edd484b5b
SHA1 145c72f8acdcd366869f955dffd000d3bc146b6e
SHA512 bc9bddbee59f165742a3203f9e2ba9de409e66de6334cb352cded84cce3e1074dbd0ac17b29e58c8729906848b64d1486fb8c848ca15422127b2baeb4c5e5dbe
SSDEEP 12288:HW7YOPcqPqvopYJNWGIbK8AJYlqWuSr7B/Uj:HW7RPcqPqvopYJYK8AyldpUj
TLSH
T176B43AC4BACB08F1E2A355B0C49BDB7F96349A050022D5BAFF5CBD59EC33746092725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PKPEKVVUSPVNJTHP.ttf

Path C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.ttf
Size 863KB
SHA256 02967e7df8a67bb315fef7588622abf4b11545cb10c4c79af6dc57d6216e8d04
MD5 b15cef0d15904bbdc72ca13c108ed822
SHA1 1bc97125de225bd2bc1e24d0a0386ea46a07343b
SHA512 fcad8c2586a2a8c172724e2d4c481f18ccca82d05bc13688a8223ef5792bb86b508bf6cf9a45e51cc5f362c1f19b9b1b06ec8740ae3c1f39673e715c6781448d
SSDEEP 24576:pezvvlo5bPUGhizWm19KmhTitgoywQRyQ:p9zTiSm1sKTitgoywQRyQ
TLSH
T13B157D7B55DF2CA9085321E0EC194B8370AFC9E44ACB4CB96E41F629A14747CA7DCB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PKPEKVVUSPVNJTHP.ubf

Path C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.ubf
Size 1B
SHA256 ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d
MD5 e4da3b7fbbce2345d7772b0674a318d5
SHA1 ac3478d69a3c81fa62e60f5c3696165a4e5e6ac4
SHA512 06df05371981a237d0ed11472fae7c94c9ac0eff1d05413516710d17b10a4fb6f4517bda4a695f02d0a73dd4db543b4653df28f5d09dab86f92ffb9b86d01e25
MD5 SHA1 SHA512

Submit Download

memory/3456-23-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-28-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-11-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-16-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-18-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-19-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-15-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-22-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-21-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-20-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-9-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-25-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-10-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-27-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-26-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-24-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-32-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-35-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-34-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-33-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-31-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-30-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-29-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-36-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/3456-37-0x0000000002A20000-0x0000000002AAB000-memory.dmp

Download

memory/3456-39-0x0000000000400000-0x0000000000482000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads