| File name: | daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08 |
| Full analysis: | https://app.any.run/tasks/2bc4135f-a68c-4fba-bc77-f52dc535d2e2 |
| Verdict: | Malicious activity |
| Threats: | DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails. |
| Analysis date: | January 10, 2025, 23:44:25 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 63B58D16A397FDF000A9AA7C5E4EE26D |
| SHA1: | D9F8246D824213E9368CA2A38F54BDF6E194A550 |
| SHA256: | DAA415845370A3B59DD929320BAD24150758A2C50108EE2B6D2BDD047FA05C08 |
| SSDEEP: | 24576:rADgrsJFhn7s6GOBaOmKyPLLJjJia0CtQ3+Celp7uV:rADgrsJFp46GOBaOmKyPLLJjJia0CtQV |
MALICIOUS
DARKCLOUD has been detected (YARA)
- aspnet_compiler.exe (PID: 6440)
SUSPICIOUS
No suspicious indicators.INFO
Checks supported languages
- aspnet_compiler.exe (PID: 6440)
- daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe (PID: 6272)
Reads the computer name
- daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe (PID: 6272)
UPX packer has been detected
- aspnet_compiler.exe (PID: 6440)
Reads the machine GUID from the registry
- daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe (PID: 6272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
DarkCloud
(PID) Process(6440) aspnet_compiler.exe
C2https://api.telegram.org/bot8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8/sendMessage?chat_id=6542615755
Strings (122)Cookies
Messages
Contacts
credentials
COMPUTERNAME
USERNAME
Screenshot
CryptoWallets
Files
\Default\Login Data
\Login Data
\user.config
//setting[@name='Username']/value
//setting[@name='Password']/value
Username :
Password :
c#8;
Software\FTPWare\CORETP\Sites
Software\Martin Prikryl\WinSCP 2\Sessions
.txt
Protocol :
Application : Pidgin
(N#i
User
Pass
Application : FileZilla
SMTP Email Address
SMTP Server
POP3 Server
POP3 User Name
SMTP User Name
NNTP Email Address
NNTP User Name
NNTP Server
IMAP Server
IMAP User Name
Email
HTTP User
HTTP Server URL
IMAP User
HTTPMail User Name
HTTPMail Server
SMTP User
^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
VBSript.RegExp
winmgmts:{impersonationLevel=impersonate}!\\
\root\default:StdReProv
Microsoft
Password
Application: Outlook
COREFTP
Application: CoreFTP
hdfzpysvpzimorhk
Application :
\U+
ekg
^(6541|656)[0-9]{12}$
BCGlobal
^389[0-9]{11}$
Carte Blanche Card
^3(?:0[0-5]|[68][0-9])[0-9]{11}$
Diners Club Card
6(?:011|5[0-9]{2})[0-9]{12}$
Discover Card
^63[7-9][0-9]{13}$
^(?:2131|1800|35\\d{3})\\d{11}$
JCB Card
^9[0-9]{15}$
KoreanLocalCard
^(6304|6706|6709|6771)[0-9]{12,15}$
Laser Card
^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$
Maestro Card
5[1-5][0-9]{14}$
Mastercard
Solo Card
Switch Card
^(62[0-9]{14,17})$
Union Pay Card
4[0-9]{12}(?:[0-9]{3})?$
Visa Card
^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$
Visa Master Card
Foxmail.exe
Express Card
\logins.json
\signons.sqlite
WScript.Shell
Storage\
mail\
Data\
\Accounts\Account.rec0
\Account.stg
\AccCfg\Accounts.tdat
\Account.rec0
EnableSignature
PeriodicCheckTime
OutgoingServer
Application : FoxMail
nextId
encryptedUsername
logins
encryptedPassword
hostname
GMf
AppData
\Local State
LOCALAPPDATA
k_Ox[:
bin.base64
P)#m
8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8
6542615755
KeyData
Application : NordVPN
POP3 User
Amex Card
^3[47][0-9]{13}$
Insta Payment Card
3[7][0-9]{13}$
OutgoingSSL
:3(
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| AssemblyVersion: | 1.0.0.0 |
|---|---|
| ProductVersion: | 1.0.0.0 |
| ProductName: | STHSFH |
| OriginalFileName: | STHSFH.exe |
| LegalTrademarks: | - |
| LegalCopyright: | Copyright © 2024 |
| InternalName: | STHSFH.exe |
| FileVersion: | 1.0.0.0 |
| FileDescription: | STHSFH |
| CompanyName: | - |
| Comments: | - |
| CharacterSet: | Unicode |
| LanguageCode: | Neutral |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Win32 |
| FileFlags: | (none) |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 1.0.0.0 |
| FileVersionNumber: | 1.0.0.0 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 4 |
| ImageVersion: | - |
| OSVersion: | 4 |
| EntryPoint: | 0x80a86 |
| UninitializedDataSize: | - |
| InitializedDataSize: | 520704 |
| CodeSize: | 519168 |
| LinkerVersion: | 48 |
| PEType: | PE32 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, Large address aware |
| TimeStamp: | 2024:12:18 07:54:52+00:00 |
| MachineType: | Intel 386 or later, and compatibles |
Total processes
131
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6272 | "C:\Users\admin\AppData\Local\Temp\daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe" | C:\Users\admin\AppData\Local\Temp\daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: STHSFH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 6432 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe | — | daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_compiler.exe Exit code: 4294967295 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 6440 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe | daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_compiler.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
DarkCloud(PID) Process(6440) aspnet_compiler.exe C2https://api.telegram.org/bot8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8/sendMessage?chat_id=6542615755 Strings (122)Cookies Messages Contacts credentials COMPUTERNAME USERNAME Screenshot CryptoWallets Files \Default\Login Data \Login Data \user.config //setting[@name='Username']/value //setting[@name='Password']/value Username : Password : c#8; Software\FTPWare\CORETP\Sites Software\Martin Prikryl\WinSCP 2\Sessions .txt Protocol : Application : Pidgin (N#i User Pass Application : FileZilla SMTP Email Address SMTP Server POP3 Server POP3 User Name SMTP User Name NNTP Email Address NNTP User Name NNTP Server IMAP Server IMAP User Name Email HTTP User HTTP Server URL IMAP User HTTPMail User Name HTTPMail Server SMTP User ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ VBSript.RegExp winmgmts:{impersonationLevel=impersonate}!\\ \root\default:StdReProv Microsoft Password Application: Outlook COREFTP Application: CoreFTP hdfzpysvpzimorhk Application : \U+ ekg ^(6541|656)[0-9]{12}$ BCGlobal ^389[0-9]{11}$ Carte Blanche Card ^3(?:0[0-5]|[68][0-9])[0-9]{11}$ Diners Club Card 6(?:011|5[0-9]{2})[0-9]{12}$ Discover Card ^63[7-9][0-9]{13}$ ^(?:2131|1800|35\\d{3})\\d{11}$ JCB Card ^9[0-9]{15}$ KoreanLocalCard ^(6304|6706|6709|6771)[0-9]{12,15}$ Laser Card ^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$ Maestro Card 5[1-5][0-9]{14}$ Mastercard Solo Card Switch Card ^(62[0-9]{14,17})$ Union Pay Card 4[0-9]{12}(?:[0-9]{3})?$ Visa Card ^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$ Visa Master Card Foxmail.exe Express Card \logins.json \signons.sqlite WScript.Shell Storage\ mail\ Data\ \Accounts\Account.rec0 \Account.stg \AccCfg\Accounts.tdat \Account.rec0 EnableSignature PeriodicCheckTime OutgoingServer Application : FoxMail nextId encryptedUsername logins encryptedPassword hostname GMf AppData \Local State LOCALAPPDATA k_Ox[: bin.base64 P)#m 8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8 6542615755 KeyData Application : NordVPN POP3 User Amex Card ^3[47][0-9]{13}$ Insta Payment Card 3[7][0-9]{13}$ OutgoingSSL :3( | |||||||||||||||
Total events
162
Read events
162
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
21
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6364 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7120 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7120 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3040 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 92.123.104.32:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 20.190.159.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |