File name: | daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08 |
Full analysis: | https://app.any.run/tasks/2bc4135f-a68c-4fba-bc77-f52dc535d2e2 |
Verdict: | Malicious activity |
Threats: | DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails. |
Analysis date: | January 10, 2025, 23:44:25 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
MD5: | 63B58D16A397FDF000A9AA7C5E4EE26D |
SHA1: | D9F8246D824213E9368CA2A38F54BDF6E194A550 |
SHA256: | DAA415845370A3B59DD929320BAD24150758A2C50108EE2B6D2BDD047FA05C08 |
SSDEEP: | 24576:rADgrsJFhn7s6GOBaOmKyPLLJjJia0CtQ3+Celp7uV:rADgrsJFp46GOBaOmKyPLLJjJia0CtQV |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (7.4) |
.exe | | | Win32 Executable (generic) (5.1) |
.exe | | | Generic Win/DOS Executable (2.2) |
.exe | | | DOS Executable Generic (2.2) |
AssemblyVersion: | 1.0.0.0 |
---|---|
ProductVersion: | 1.0.0.0 |
ProductName: | STHSFH |
OriginalFileName: | STHSFH.exe |
LegalTrademarks: | - |
LegalCopyright: | Copyright © 2024 |
InternalName: | STHSFH.exe |
FileVersion: | 1.0.0.0 |
FileDescription: | STHSFH |
CompanyName: | - |
Comments: | - |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.0.0.0 |
FileVersionNumber: | 1.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x80a86 |
UninitializedDataSize: | - |
InitializedDataSize: | 520704 |
CodeSize: | 519168 |
LinkerVersion: | 48 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, No line numbers, No symbols, Large address aware |
TimeStamp: | 2024:12:18 07:54:52+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6272 | "C:\Users\admin\AppData\Local\Temp\daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe" | C:\Users\admin\AppData\Local\Temp\daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: STHSFH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
6432 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe | — | daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_compiler.exe Exit code: 4294967295 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
6440 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe | daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_compiler.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
DarkCloud(PID) Process(6440) aspnet_compiler.exe C2https://api.telegram.org/bot8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8/sendMessage?chat_id=6542615755 Strings (122)Cookies Messages Contacts credentials COMPUTERNAME USERNAME Screenshot CryptoWallets Files \Default\Login Data \Login Data \user.config //setting[@name='Username']/value //setting[@name='Password']/value Username : Password : c#8; Software\FTPWare\CORETP\Sites Software\Martin Prikryl\WinSCP 2\Sessions .txt Protocol : Application : Pidgin (N#i User Pass Application : FileZilla SMTP Email Address SMTP Server POP3 Server POP3 User Name SMTP User Name NNTP Email Address NNTP User Name NNTP Server IMAP Server IMAP User Name Email HTTP User HTTP Server URL IMAP User HTTPMail User Name HTTPMail Server SMTP User ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ VBSript.RegExp winmgmts:{impersonationLevel=impersonate}!\\ \root\default:StdReProv Microsoft Password Application: Outlook COREFTP Application: CoreFTP hdfzpysvpzimorhk Application : \U+ ekg ^(6541|656)[0-9]{12}$ BCGlobal ^389[0-9]{11}$ Carte Blanche Card ^3(?:0[0-5]|[68][0-9])[0-9]{11}$ Diners Club Card 6(?:011|5[0-9]{2})[0-9]{12}$ Discover Card ^63[7-9][0-9]{13}$ ^(?:2131|1800|35\\d{3})\\d{11}$ JCB Card ^9[0-9]{15}$ KoreanLocalCard ^(6304|6706|6709|6771)[0-9]{12,15}$ Laser Card ^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$ Maestro Card 5[1-5][0-9]{14}$ Mastercard Solo Card Switch Card ^(62[0-9]{14,17})$ Union Pay Card 4[0-9]{12}(?:[0-9]{3})?$ Visa Card ^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$ Visa Master Card Foxmail.exe Express Card \logins.json \signons.sqlite WScript.Shell Storage\ mail\ Data\ \Accounts\Account.rec0 \Account.stg \AccCfg\Accounts.tdat \Account.rec0 EnableSignature PeriodicCheckTime OutgoingServer Application : FoxMail nextId encryptedUsername logins encryptedPassword hostname GMf AppData \Local State LOCALAPPDATA k_Ox[: bin.base64 P)#m 8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8 6542615755 KeyData Application : NordVPN POP3 User Amex Card ^3[47][0-9]{13}$ Insta Payment Card 3[7][0-9]{13}$ OutgoingSSL :3( |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6364 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7120 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7120 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3040 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 92.123.104.32:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 20.190.159.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |