| File name: | Bestelverzoek.exe |
| Full analysis: | https://app.any.run/tasks/f91cd7e7-c803-4497-a599-fef7f2a99cd6 |
| Verdict: | Malicious activity |
| Threats: | DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails. |
| Analysis date: | April 29, 2025, 12:47:22 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 422B54CB102C3200FED3AA71422B64A3 |
| SHA1: | 60A9CBF1A8BB230FE4F59C02D76020A4434B8472 |
| SHA256: | 9B9C1674FCFCB27A77923AB0926D6D879004FEDFD38FC5611E05C964E8C93A8E |
| SSDEEP: | 49152:Tkrv8gkkrvefEZF93v5IKLns0Hrga4GGGLFniZ6DwWV7CoGja0oSRhhaaS5wCcCw:Tkrv8gkkrvefEZXFLnsC8a4kpiZA9Eou |
MALICIOUS
DARKCLOUD has been detected (YARA)
- Bestelverzoek.exe (PID: 5124)
SUSPICIOUS
Application launched itself
- Bestelverzoek.exe (PID: 6036)
INFO
Checks supported languages
- Bestelverzoek.exe (PID: 6036)
- Bestelverzoek.exe (PID: 5124)
Reads the computer name
- Bestelverzoek.exe (PID: 6036)
Reads the machine GUID from the registry
- Bestelverzoek.exe (PID: 6036)
UPX packer has been detected
- Bestelverzoek.exe (PID: 5124)
Reads the software policy settings
- slui.exe (PID: 6048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
DarkCloud
(PID) Process(5124) Bestelverzoek.exe
C2https://api.telegram.org/bot6107929879:AAHV6JwXs7rcYzMGLe3_opR5_gdKAC16Ye4/sendMessage?chat_id=6311012313
Strings (92)Cookies
Messages
Contacts
credentials
COMPUTERNAME
USERNAME
Screenshot
KeyData
CryptoWallets
Files
\Default\Login Data
\Login Data
\user.config
Username :
Password :
Application : NordVPN
DMyzQCVqsRLfeutkyCdMdhotUpqGD_
ScICgUzHj
Zcf+ gKXc
.txt
Protocol :
Application : Pidgin
Host
Port
s_Bi
Application : FileZill
SMTP Email Address
POP3 Server
H\W;8xoHh!\nMJ
SMTP User Name
NNTP Email Address
NNTP User Name
NNTP Server
IMAP User Name
Email
HTTP User
HTTP Server URL
IMAP User
HTTPMail User Name
HTTPMail Server
VBScript.RegExp
\root\default:StdRegProv
Password
Application: Outlook
COREFTP
Application: CoreFTP
hdfzpysvpzimorhk
Application :
^3[47][0-9]{13}$
Amex Card
BCGlobal
^389[0-9]{11}$
Carte Blanche Card
Diners Club Card
Discover Card
^63[7-9][0-9]{13}$
Insta Payment Card
JCB Card
KoreanLocalCard
SfhxL!WVXu
Maestro Card
Mastercard
Switch Card
^(62[0-9]{14,17})$
Union Pay Card
Visa Card
Express Card
\signons.sqlite
WScript.Shell
Foxmail.ex
Storage\
mail\
Data\
\Account.stg
\AccCfg\Accounts.tdat
\Account.rec0
EnableSignature
dMEknQKFIrNAaUoVx
Application : FoxMail
nextId
encryptedUsername
logins
encryptedPassword
kZSwSeFw
rypu
\Local State
LOCALAPPDATA
AppData
CUSTOM
bin.base64
.zip
http://showip.net
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:04:29 00:26:30+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 946176 |
| InitializedDataSize: | 10752 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xe8f0a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | Engaging word puzzle game with multiple challenge levels and vocabulary enhancement |
| CompanyName: | Phantom Dimension Software |
| FileDescription: | LexiQuest Deluxe |
| FileVersion: | 1.0.0.0 |
| InternalName: | oRJW.exe |
| LegalCopyright: | Copyright © Phantom Dimension Software 2025 |
| LegalTrademarks: | LexiQuest™ |
| OriginalFileName: | oRJW.exe |
| ProductName: | LexiQuest Deluxe |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.3.0 |
Total processes
134
Monitored processes
5
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2040 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5124 | "C:\Users\admin\AppData\Local\Temp\Bestelverzoek.exe" | C:\Users\admin\AppData\Local\Temp\Bestelverzoek.exe | Bestelverzoek.exe | ||||||||||||
User: admin Company: Phantom Dimension Software Integrity Level: MEDIUM Description: LexiQuest Deluxe Version: 1.0.0.0 Modules
DarkCloud(PID) Process(5124) Bestelverzoek.exe C2https://api.telegram.org/bot6107929879:AAHV6JwXs7rcYzMGLe3_opR5_gdKAC16Ye4/sendMessage?chat_id=6311012313 Strings (92)Cookies Messages Contacts credentials COMPUTERNAME USERNAME Screenshot KeyData CryptoWallets Files \Default\Login Data \Login Data \user.config Username : Password : Application : NordVPN DMyzQCVqsRLfeutkyCdMdhotUpqGD_ ScICgUzHj Zcf+ gKXc .txt Protocol : Application : Pidgin Host Port s_Bi Application : FileZill SMTP Email Address POP3 Server H\W;8xoHh!\nMJ SMTP User Name NNTP Email Address NNTP User Name NNTP Server IMAP User Name Email HTTP User HTTP Server URL IMAP User HTTPMail User Name HTTPMail Server VBScript.RegExp \root\default:StdRegProv Password Application: Outlook COREFTP Application: CoreFTP hdfzpysvpzimorhk Application : ^3[47][0-9]{13}$ Amex Card BCGlobal ^389[0-9]{11}$ Carte Blanche Card Diners Club Card Discover Card ^63[7-9][0-9]{13}$ Insta Payment Card JCB Card KoreanLocalCard SfhxL!WVXu Maestro Card Mastercard Switch Card ^(62[0-9]{14,17})$ Union Pay Card Visa Card Express Card \signons.sqlite WScript.Shell Foxmail.ex Storage\ mail\ Data\ \Account.stg \AccCfg\Accounts.tdat \Account.rec0 EnableSignature dMEknQKFIrNAaUoVx Application : FoxMail nextId encryptedUsername logins encryptedPassword kZSwSeFw rypu \Local State LOCALAPPDATA AppData CUSTOM bin.base64 .zip http://showip.net | |||||||||||||||
| 5176 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6036 | "C:\Users\admin\AppData\Local\Temp\Bestelverzoek.exe" | C:\Users\admin\AppData\Local\Temp\Bestelverzoek.exe | — | explorer.exe | |||||||||||
User: admin Company: Phantom Dimension Software Integrity Level: MEDIUM Description: LexiQuest Deluxe Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 6048 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
678
Read events
678
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
23
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.20:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1676 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1676 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.216.77.20:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.31.128:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |