File name: | 1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193 |
Full analysis: | https://app.any.run/tasks/f7a11b4b-9412-4e5f-bbef-a2d53627dc45 |
Verdict: | Malicious activity |
Threats: | DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails. |
Analysis date: | January 10, 2025, 20:35:29 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
MD5: | D6F82E86174054C3CBA4742357140A12 |
SHA1: | 5D4CA46D5A1D63F4921D44F000D6CC18D207A5E6 |
SHA256: | 1BC1A64C3C4522637CDB3923165A1AEB95376D05F905C1DB18CA14A572AC9193 |
SSDEEP: | 49152:g4suEPl0fZpUJuKd7WxhMwhVJXTcMIZWV7vQZR0IMcVMGmjHsvQqNl6nklKqB/pR:iuEPl0fZpUJuKd7Wj9VDVvQLtDV8jHcn |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
---|---|---|
.exe | | | Win64 Executable (generic) (21.3) |
.scr | | | Windows screen saver (10.1) |
.dll | | | Win32 Dynamic Link Library (generic) (5) |
.exe | | | Win32 Executable (generic) (3.4) |
AssemblyVersion: | 1.0.0.0 |
---|---|
ProductVersion: | 1.0.0.0 |
ProductName: | Jiles |
OriginalFileName: | Jiles.exe |
LegalTrademarks: | - |
LegalCopyright: | Copyright © 2024 |
InternalName: | Jiles.exe |
FileVersion: | 1.0.0.0 |
FileDescription: | Jiles |
CompanyName: | - |
Comments: | - |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.0.0.0 |
FileVersionNumber: | 1.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x187c8e |
UninitializedDataSize: | - |
InitializedDataSize: | 2048 |
CodeSize: | 1596928 |
LinkerVersion: | 48 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2050:10:27 12:55:07+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6292 | "C:\Users\admin\AppData\Local\Temp\1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193.exe" | C:\Users\admin\AppData\Local\Temp\1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Jiles Version: 1.0.0.0 Modules
| |||||||||||||||
6336 | "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\admin\AppData\Local\Temp\1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193.exe' 'C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe' | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | 1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6344 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6404 | "C:\Users\admin\AppData\Local\Temp\1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193.exe" | C:\Users\admin\AppData\Local\Temp\1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193.exe | 1bc1a64c3c4522637cdb3923165a1aeb95376d05f905c1db18ca14a572ac9193.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Jiles Version: 1.0.0.0 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
6336 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:EB24CE58153EFE9A91857207D676BDE6 | SHA256:A650920EDFC7278A4B98F707F9AF05E819CCDD7D7122AAB6E685F5065B0DBEA4 | |||
6336 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe | executable | |
MD5:D6F82E86174054C3CBA4742357140A12 | SHA256:1BC1A64C3C4522637CDB3923165A1AEB95376D05F905C1DB18CA14A572AC9193 | |||
6336 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_c21gmafu.e2l.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
6336 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_t4aj1c5q.pj3.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5964 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
7012 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5964 | RUXIMICS.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
836 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
836 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
876 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5964 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5964 | RUXIMICS.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5964 | RUXIMICS.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
876 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3976 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |