File name:

DHL-Documento de envío.exe

Full analysis: https://app.any.run/tasks/02b03785-ad75-4f9e-99ae-a24613d58db9
Verdict: Malicious activity
Threats:

DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails.

Malware Trends Tracker     >>>
Analysis date: March 13, 2025, 16:39:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
autorun-startup
darkcloud
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

DE97DCB97605765953A3C706CC504171

SHA1:

88238AF01DD0D84FCB17754AC4AFD12E7562EB2C

SHA256:

8EED39069DFA0574B41E3E3F426809E29F9B108D5106670E07B2C1524085B6E6

SSDEEP:

1536:ZVa4hsTzu+H568XDtNi9DNGNZZCRj3DaiFvhiZnLDV6J9P5xUEZsuf7QzFFWzA99:t23QUDhdWe2vIX9CuzISt0//rQ7bv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • DHL-Documento de envío.exe (PID: 6080)

    • Steals credentials from Web Browsers

      • InstallUtil.exe (PID: 4724)
      • InstallUtil.exe (PID: 7084)

    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 4724)
      • InstallUtil.exe (PID: 7084)

    • DARKCLOUD has been detected (YARA)

      • InstallUtil.exe (PID: 4724)
      • InstallUtil.exe (PID: 7084)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • DHL-Documento de envío.exe (PID: 6080)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 4212)

  • INFO

    • Checks supported languages

      • DHL-Documento de envío.exe (PID: 6080)
      • InstallUtil.exe (PID: 4724)
      • Description.exe (PID: 2564)
      • InstallUtil.exe (PID: 7084)

    • Reads the computer name

      • DHL-Documento de envío.exe (PID: 6080)
      • InstallUtil.exe (PID: 4724)

    • Reads the software policy settings

      • DHL-Documento de envío.exe (PID: 6080)
      • Description.exe (PID: 2564)

    • Disables trace logs

      • DHL-Documento de envío.exe (PID: 6080)

    • Checks proxy server information

      • DHL-Documento de envío.exe (PID: 6080)

    • Reads the machine GUID from the registry

      • DHL-Documento de envío.exe (PID: 6080)
      • InstallUtil.exe (PID: 4724)
      • InstallUtil.exe (PID: 7084)

    • Creates files or folders in the user directory

      • DHL-Documento de envío.exe (PID: 6080)
      • InstallUtil.exe (PID: 4724)
      • InstallUtil.exe (PID: 7084)

    • Autorun file from Startup directory

      • DHL-Documento de envío.exe (PID: 6080)

    • Manual execution by a user

      • InstallUtil.exe (PID: 4724)
      • wscript.exe (PID: 4212)
      • InstallUtil.exe (PID: 7084)

    • UPX packer has been detected

      • InstallUtil.exe (PID: 4724)
      • InstallUtil.exe (PID: 7084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:13 15:28:48+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 159744
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x28f9e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Lonbjj
FileVersion: 1.0.0.0
InternalName: Lonbjj.exe
LegalCopyright: Copyright © 2013
LegalTrademarks: -
OriginalFileName: Lonbjj.exe
ProductName: Lonbjj
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
8
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dhl-documento de envã­o.exe sppextcomobj.exe no specs slui.exe #DARKCLOUD installutil.exe wscript.exe no specs description.exe #DARKCLOUD installutil.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
900C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1568"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2564"C:\Users\admin\AppData\Roaming\Description.exe" C:\Users\admin\AppData\Roaming\Description.exe
wscript.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Lonbjj
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\description.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4212"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Description.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4724"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
4996C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6080"C:\Users\admin\AppData\Local\Temp\DHL-Documento de envío.exe" C:\Users\admin\AppData\Local\Temp\DHL-Documento de envío.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Lonbjj
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dhl-documento de envã­o.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7084"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
Total events
3 348
Read events
3 320
Write events
28
Delete events
0

Modification events

(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6080) DHL-Documento de envío.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL-Documento de envío_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
6
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6080DHL-Documento de envío.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Description.vbstext
MD5:3BE01CF14AE6D88D8F05EFA854F73949
SHA256:57520FFF754760E086EF3D551BED31B6400F90181D1D640721CB3761D8EF9D09
4724InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\LoginDatabinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
7084InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\keyDBPath.dbbinary
MD5:0FF3BCDD0BE077B9EB8194B5C09F453C
SHA256:225D669E47EB14D8C969799C92AAEF27B66CD984872EA09284E48DB46521E651
4724InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\WebDatabinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
7084InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\WebDatabinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
7084InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\LoginDatabinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
6080DHL-Documento de envío.exeC:\Users\admin\AppData\Roaming\Description.exeexecutable
MD5:DE97DCB97605765953A3C706CC504171
SHA256:8EED39069DFA0574B41E3E3F426809E29F9B108D5106670E07B2C1524085B6E6
4724InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\keyDBPath.dbbinary
MD5:0FF3BCDD0BE077B9EB8194B5C09F453C
SHA256:225D669E47EB14D8C969799C92AAEF27B66CD984872EA09284E48DB46521E651
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.115.184:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4208
backgroundTaskHost.exe
GET
200
2.23.115.184:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6964
SIHClient.exe
GET
200
23.200.213.221:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6964
SIHClient.exe
GET
200
23.200.213.221:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6080
DHL-Documento de envío.exe
162.241.60.209:443
gugaequiposyservicios.com.mx
UNIFIEDLAYER-AS-1
US
unknown
6544
svchost.exe
2.23.115.184:80
ocsp.digicert.com
TELECOM ITALIA SPARKLE S.p.A.
NL
whitelisted
4208
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4208
backgroundTaskHost.exe
2.23.115.184:80
ocsp.digicert.com
TELECOM ITALIA SPARKLE S.p.A.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
google.com
  • 142.250.185.174
whitelisted
gugaequiposyservicios.com.mx
  • 162.241.60.209
unknown
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.71
  • 40.126.31.1
  • 20.190.159.23
  • 20.190.159.73
  • 40.126.31.0
  • 40.126.31.129
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.23.115.184
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.200.213.221
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DHL-Documento de envío.exe