darkcloud | a6093c7a16fdfcd38a435628a5e1f1624e09846ead33d78aeb79892587cccf61

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SS.ps1
Size 2.6MB
Sample261027-hchnfabz6p
SHA256 a6093c7a16fdfcd38a435628a5e1f1624e09846ead33d78aeb79892587cccf61
MD5 4d4b9ff1d126ea619f0172eb673b4337
SHA1 281753a37c8ca1c9140c8678411d65b5b1c63440
SHA512 dffae14050936205fb9dd5baa29dc49ecf067b8c6e120c20b93972f57e1b372344eb59b8ca5ff222bf127c5d094458a32ea1b6ff7f1026fe188ce554839c5905
SSDEEP 49152:6yBSnO8TioqOsVImwgRvvEL/db95KDg4YFoZXCa:p
TLSH
T16DC5233CCD4D63DD0921E2F9F647788831EC23C64987171392A889A836EC971DF679B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darkcloud stealer

Malware Config

Extracted

Family

darkcloud

Version

Attributes

email_from
[email protected]
email_to
[email protected]
host_password
Mystic1@
host_server
mail.privateemail.com

Signatures

Family: DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Executes dropped EXE 1 IoCs

pid	Process
1896	GoogleChrome.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/1548-19-0x000001FD56590000-0x000001FD565A6000-memory.dmp	ConfuserEx

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2444	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 5008	1548	PowerShell.exe	90

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\GoogleChrome.exe	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1548	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleChrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5040	taskkill.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe
1548	PowerShell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5008	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	PowerShell.exe
Token: SeDebugPrivilege	5040	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5008	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 5008	1548	PowerShell.exe	90
PID 1548 wrote to memory of 5008	1548	PowerShell.exe	90
PID 1548 wrote to memory of 5008	1548	PowerShell.exe	90
PID 1548 wrote to memory of 5008	1548	PowerShell.exe	90
PID 1548 wrote to memory of 5008	1548	PowerShell.exe	90
PID 5008 wrote to memory of 5040	5008	aspnet_compiler.exe	92
PID 5008 wrote to memory of 2444	5008	aspnet_compiler.exe	94
PID 2444 wrote to memory of 1896	2444	wscript.exe	95

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\SS.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\\Users\Public\strEncodedData.vbs" /elevated
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Program Files\Google\Chrome\Application\GoogleChrome.exe
      "C:\\Program Files\Google\Chrome\Application\GoogleChrome.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleChrome.exe

Path C:\Program Files\Google\Chrome\Application\GoogleChrome.exe
Size 81KB
SHA256 bab3b43558a3c1de2aee7014b8d50306d19f67399836066bd50f1dfedf053664
MD5 71948b29e1ae6ade71c104f09f8c122d
SHA1 96c3809d12b34331b823305e7ab7daa0905af742
SHA512 6e18cc3c9255fb7fbd1c1a2051ba673678b8f31eb71898fa90194a1207bb24499d287221acd69b6bd451ac5b20cf010de537147b0651fd51307b15eb73c5508f
SSDEEP 1536:BhEBrut+S+URZBQ/jNJ75aI+m77nED3zKjcFQeTLHV/wsWL4qcdle7HvUy:fiut+VUnBQ7N6m77nED3zKjkTL1nrlGb
TLSH
T13C836A91B5D1C8B1E4360D3518B8DAE19E2EFD304E259E6B3388067F4F346D09A25E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gxsobcnr.4n0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxsobcnr.4n0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

EncKeyChrome.txt

Path C:\Users\Public\EncKeyChrome.txt
Size 1KB
SHA256 fe10c00edc3ae4d595ff192775482d902ee802bffef44f0d7d101f3948c1c987
MD5 5303deaa596b9e66c2b7cc43eb0b2970
SHA1 214ea5cdb7a059ab73481393140935e47dfb1e0d
SHA512 2397f5496a9d3b286ee90af5d7380a34590499b57459e74a51bfca57cd5e5de176c1d7b6f541af39ad04a231cad17d812cde54718fd33ad7d103e872788cc345
TLSH
T1D821E7C080C30A85F607F81AD0E4F36383B83C6790C46101AB7BE5C98F99A195E4DF1A
MD5 SHA1 SHA512 TLSH

Submit Download

strEncodedData.txt

Path C:\Users\Public\strEncodedData.txt
Size 109KB
SHA256 e1aed522b8cee663c3f66d8d79355849c437edf0ebe9d90b5006f15adcae3622
MD5 c5b0406b353c7a71e5a01f8f699b6f29
SHA1 e0bf526341c0da36d7063b8203bca300f434d5e6
SHA512 fb49f4daad9b5b08aa8b213526ec3629b1e19852cebab5a96732bf93993f6b8d9baf88c6ecc21e150b8bf1721edbea6b4f22bd49adae7b6273ad8b8c63f40c91
SSDEEP 1536:ZJDlt2vnB2FwlaGvFxrnzLSxkbx/bARm/Psz4K1lXvg09gaiPZNN17mCGYnp:ZJpInB2+laG9BCxkbxzEmXsz4SpCPLFp
TLSH
T177B37C378517BEAA072E2E889C0C2D525D782FE7C7388664EAC95C67B18A404DF5D4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

strEncodedData.vbs

Path C:\Users\Public\strEncodedData.vbs
Size 4KB
SHA256 0f04317279b66cfc825bfce4fb9ca7d211a7018b4539abb9742a6e9689f8e889
MD5 fd14cd1faab2b2cff2aa12990df19c93
SHA1 7e1804a6c7c34d9feec35e15a73ddc010a611a6e
SHA512 f3ae8784ff4002cd49c975a5c9316879c63f9e8b153eedc9d25937e54056ae68688f22f0e692934cbe5c3f71ddf96887b98eb8965a707f3d0138415c51b91729
SSDEEP 96:qmA6a/QG7MJUGOb0KsSsG9Li25Bf8RgkA7EigidUiwQPSWETiPl+iwz:qBYG4CGi0LSsG9L3ofigiWihRUiPl+iW
TLSH
T18C913026DC6AEAC52DF2DE89D9D10584FE9D0813B590692CFC34728E1F685E727F2884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-12-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-24-0x000001FD565D0000-0x000001FD566FF000-memory.dmp

Download

memory/1548-0-0x00007FFEC5F2F000-0x00007FFEC5F30000-memory.dmp

Download

memory/1548-13-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-14-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-15-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-16-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-17-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-18-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-19-0x000001FD56590000-0x000001FD565A6000-memory.dmp

Download

memory/1548-20-0x000001FD565A0000-0x000001FD565A6000-memory.dmp

Download

memory/1548-67-0x000001FD565D0000-0x000001FD566FF000-memory.dmp

Download

memory/1548-66-0x000001FD565D0000-0x000001FD566FF000-memory.dmp

Download

memory/1548-11-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-65-0x000001FD565D0000-0x000001FD566FF000-memory.dmp

Download

memory/1548-40-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-10-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-9-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-7-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-6-0x000001FD56520000-0x000001FD56542000-memory.dmp

Download

memory/1548-54-0x00007FFEC5DA0000-0x00007FFEC6744000-memory.dmp

Download

memory/1548-64-0x000001FD565D0000-0x000001FD566FF000-memory.dmp

Download

memory/5008-56-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/5008-27-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/5008-23-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/5008-21-0x0000000000400000-0x000000000048C000-memory.dmp

Download