darkcloud | 315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe
Size 1.3MB
Sample260910-mkhevs1gqb
SHA256 315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73
MD5 c74be92dd011878057f09fbbe27aef34
SHA1 4de09412f154abeea3d760344bb110bbe409f469
SHA512 a9caaadda7b171de24806fa772570f0dc06429c5045628468b4ea06577ccb436e957d4330a65c6b3e6514a63f7bebf10df0705e3e39dea815ef343a627b5ddc3
SSDEEP 24576:gRX3O76WmWv4n8ZYbFGeeQ2pDHyyFQXJCMCQ18FRo66T:ghy6WmDVFGeeQ2pDSyFQ5CjC8W66T
TLSH
T1445501742A04D981D86547BBC860E2F437B55DB4E931C2138AEB7DFBBD3A71014E92B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery evasion execution darkcloud persistence stealer trojan

Malware Config

Extracted

Family

darkcloud

Version

Signatures

Family: DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	OnuRfcwNLQlQyZ.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4480	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1828	OnuRfcwNLQlQyZ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\OnuRfcwNLQlQyZ = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$pbw1l1=2526;$fbhm1w=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$fi1fti=[System.Environment]::TickCount;$5vjlqj=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXE9udVJmY3dOTFFsUXlaLmV4ZQ==')));$fi1fti=[System.Environment]::TickCount;& $fbhm1w -FilePath $5vjlqj\""	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3936 set thread context of 2824	3936	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe	89
PID 1828 set thread context of 1968	1828	OnuRfcwNLQlQyZ.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OnuRfcwNLQlQyZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	MSBuild.exe
1968	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 2824	3936	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe	89
PID 3936 wrote to memory of 2824	3936	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe	89
PID 3936 wrote to memory of 2824	3936	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe	89
PID 3936 wrote to memory of 2824	3936	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe	89
PID 3936 wrote to memory of 2824	3936	315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe	89
PID 4480 wrote to memory of 1828	4480	powershell.exe	92
PID 1828 wrote to memory of 1968	1828	OnuRfcwNLQlQyZ.exe	94
PID 1828 wrote to memory of 1968	1828	OnuRfcwNLQlQyZ.exe	94
PID 1828 wrote to memory of 1968	1828	OnuRfcwNLQlQyZ.exe	94
PID 1828 wrote to memory of 1968	1828	OnuRfcwNLQlQyZ.exe	94
PID 1828 wrote to memory of 1968	1828	OnuRfcwNLQlQyZ.exe	94

C:\Users\Admin\AppData\Local\Temp\315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe
"C:\Users\Admin\AppData\Local\Temp\315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2824

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$pbw1l1=2526;$fbhm1w=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$fi1fti=[System.Environment]::TickCount;$5vjlqj=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXE9udVJmY3dOTFFsUXlaLmV4ZQ==')));$fi1fti=[System.Environment]::TickCount;& $fbhm1w -FilePath $5vjlqj"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Roaming\OnuRfcwNLQlQyZ.exe
  "C:\Users\Admin\AppData\Roaming\OnuRfcwNLQlQyZ.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OnuRfcwNLQlQyZ.exe

Path C:\Users\Admin\AppData\Roaming\OnuRfcwNLQlQyZ.exe
Size 1.3MB
SHA256 315a48c4b71090772b808f0c4dfe0ecfac9b61909cb14986d465f326fb706c73
MD5 c74be92dd011878057f09fbbe27aef34
SHA1 4de09412f154abeea3d760344bb110bbe409f469
SHA512 a9caaadda7b171de24806fa772570f0dc06429c5045628468b4ea06577ccb436e957d4330a65c6b3e6514a63f7bebf10df0705e3e39dea815ef343a627b5ddc3
SSDEEP 24576:gRX3O76WmWv4n8ZYbFGeeQ2pDHyyFQXJCMCQ18FRo66T:ghy6WmDVFGeeQ2pDSyFQ5CjC8W66T
TLSH
T1445501742A04D981D86547BBC860E2F437B55DB4E931C2138AEB7DFBBD3A71014E92B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1828-31-0x0000000005CD0000-0x000000000602B000-memory.dmp

Download

memory/2824-13-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/2824-32-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/2824-15-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/3936-12-0x0000000009870000-0x000000000997E000-memory.dmp

Download

memory/3936-0-0x0000000074D02000-0x0000000074D03000-memory.dmp

Download

memory/3936-7-0x0000000074CF0000-0x00000000754AC000-memory.dmp

Download

memory/3936-8-0x0000000005510000-0x0000000005530000-memory.dmp

Download

memory/3936-9-0x0000000074D02000-0x0000000074D03000-memory.dmp

Download

memory/3936-10-0x0000000074CF0000-0x00000000754AC000-memory.dmp

Download

memory/3936-11-0x0000000009660000-0x00000000096FC000-memory.dmp

Download

memory/3936-3-0x00000000051A0000-0x0000000005232000-memory.dmp

Download

memory/3936-5-0x0000000005150000-0x0000000005172000-memory.dmp

Download

memory/3936-4-0x0000000005C80000-0x0000000005FDB000-memory.dmp

Download

memory/3936-18-0x0000000074CF0000-0x00000000754AC000-memory.dmp

Download

memory/3936-6-0x00000000052A0000-0x00000000052AA000-memory.dmp

Download

memory/3936-1-0x00000000004E0000-0x0000000000628000-memory.dmp

Download

memory/3936-2-0x00000000056C0000-0x0000000005C7A000-memory.dmp

Download

memory/4480-19-0x00007FFBA6A5F000-0x00007FFBA6A60000-memory.dmp

Download

memory/4480-25-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4480-26-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4480-27-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4480-24-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4480-23-0x000001A161FD0000-0x000001A161FF2000-memory.dmp

Download

memory/4480-30-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download

memory/4480-22-0x00007FFBA68D0000-0x00007FFBA7274000-memory.dmp

Download