File name:

daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08

Full analysis: https://app.any.run/tasks/2bc4135f-a68c-4fba-bc77-f52dc535d2e2
Verdict: Malicious activity
Threats:

DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails.

Analysis date: January 10, 2025, 23:44:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
darkcloud
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

63B58D16A397FDF000A9AA7C5E4EE26D

SHA1:

D9F8246D824213E9368CA2A38F54BDF6E194A550

SHA256:

DAA415845370A3B59DD929320BAD24150758A2C50108EE2B6D2BDD047FA05C08

SSDEEP:

24576:rADgrsJFhn7s6GOBaOmKyPLLJjJia0CtQ3+Celp7uV:rADgrsJFp46GOBaOmKyPLLJjJia0CtQV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • DARKCLOUD has been detected (YARA)

      • aspnet_compiler.exe (PID: 6440)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Checks supported languages

      • aspnet_compiler.exe (PID: 6440)
      • daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe (PID: 6272)
    • Reads the computer name

      • daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe (PID: 6272)
    • UPX packer has been detected

      • aspnet_compiler.exe (PID: 6440)
    • Reads the machine GUID from the registry

      • daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe (PID: 6272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DarkCloud

(PID) Process(6440) aspnet_compiler.exe
C2https://api.telegram.org/bot8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8/sendMessage?chat_id=6542615755
Strings (122)Cookies
Messages
Contacts
credentials
COMPUTERNAME
USERNAME
Screenshot
CryptoWallets
Files
\Default\Login Data
\Login Data
\user.config
//setting[@name='Username']/value
//setting[@name='Password']/value
Username :
Password :
c#8;
Software\FTPWare\CORETP\Sites
Software\Martin Prikryl\WinSCP 2\Sessions
.txt
Protocol :
Application : Pidgin
(N#i
User
Pass
Application : FileZilla
SMTP Email Address
SMTP Server
POP3 Server
POP3 User Name
SMTP User Name
NNTP Email Address
NNTP User Name
NNTP Server
IMAP Server
IMAP User Name
Email
HTTP User
HTTP Server URL
IMAP User
HTTPMail User Name
HTTPMail Server
SMTP User
^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
VBSript.RegExp
winmgmts:{impersonationLevel=impersonate}!\\
\root\default:StdReProv
Microsoft
Password
Application: Outlook
COREFTP
Application: CoreFTP
hdfzpysvpzimorhk
Application :
\U+
ekg
^(6541|656)[0-9]{12}$
BCGlobal
^389[0-9]{11}$
Carte Blanche Card
^3(?:0[0-5]|[68][0-9])[0-9]{11}$
Diners Club Card
6(?:011|5[0-9]{2})[0-9]{12}$
Discover Card
^63[7-9][0-9]{13}$
^(?:2131|1800|35\\d{3})\\d{11}$
JCB Card
^9[0-9]{15}$
KoreanLocalCard
^(6304|6706|6709|6771)[0-9]{12,15}$
Laser Card
^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$
Maestro Card
5[1-5][0-9]{14}$
Mastercard
Solo Card
Switch Card
^(62[0-9]{14,17})$
Union Pay Card
4[0-9]{12}(?:[0-9]{3})?$
Visa Card
^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$
Visa Master Card
Foxmail.exe
Express Card
\logins.json
\signons.sqlite
WScript.Shell
Storage\
mail\
Data\
\Accounts\Account.rec0
\Account.stg
\AccCfg\Accounts.tdat
\Account.rec0
EnableSignature
PeriodicCheckTime
OutgoingServer
Application : FoxMail
nextId
encryptedUsername
logins
encryptedPassword
hostname
GMf
AppData
\Local State
LOCALAPPDATA
k_Ox[:
bin.base64
P)#m
8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8
6542615755
KeyData
Application : NordVPN
POP3 User
Amex Card
^3[47][0-9]{13}$
Insta Payment Card
3[7][0-9]{13}$
OutgoingSSL
:3(
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

AssemblyVersion: 1.0.0.0
ProductVersion: 1.0.0.0
ProductName: STHSFH
OriginalFileName: STHSFH.exe
LegalTrademarks: -
LegalCopyright: Copyright © 2024
InternalName: STHSFH.exe
FileVersion: 1.0.0.0
FileDescription: STHSFH
CompanyName: -
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x80a86
UninitializedDataSize: -
InitializedDataSize: 520704
CodeSize: 519168
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware
TimeStamp: 2024:12:18 07:54:52+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe no specs aspnet_compiler.exe no specs #DARKCLOUD aspnet_compiler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6272"C:\Users\admin\AppData\Local\Temp\daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe" C:\Users\admin\AppData\Local\Temp\daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
STHSFH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6432"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exedaa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6440"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
daa415845370a3b59dd929320bad24150758a2c50108ee2b6d2bdd047fa05c08.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
DarkCloud
(PID) Process(6440) aspnet_compiler.exe
C2https://api.telegram.org/bot8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8/sendMessage?chat_id=6542615755
Strings (122)Cookies
Messages
Contacts
credentials
COMPUTERNAME
USERNAME
Screenshot
CryptoWallets
Files
\Default\Login Data
\Login Data
\user.config
//setting[@name='Username']/value
//setting[@name='Password']/value
Username :
Password :
c#8;
Software\FTPWare\CORETP\Sites
Software\Martin Prikryl\WinSCP 2\Sessions
.txt
Protocol :
Application : Pidgin
(N#i
User
Pass
Application : FileZilla
SMTP Email Address
SMTP Server
POP3 Server
POP3 User Name
SMTP User Name
NNTP Email Address
NNTP User Name
NNTP Server
IMAP Server
IMAP User Name
Email
HTTP User
HTTP Server URL
IMAP User
HTTPMail User Name
HTTPMail Server
SMTP User
^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
VBSript.RegExp
winmgmts:{impersonationLevel=impersonate}!\\
\root\default:StdReProv
Microsoft
Password
Application: Outlook
COREFTP
Application: CoreFTP
hdfzpysvpzimorhk
Application :
\U+
ekg
^(6541|656)[0-9]{12}$
BCGlobal
^389[0-9]{11}$
Carte Blanche Card
^3(?:0[0-5]|[68][0-9])[0-9]{11}$
Diners Club Card
6(?:011|5[0-9]{2})[0-9]{12}$
Discover Card
^63[7-9][0-9]{13}$
^(?:2131|1800|35\\d{3})\\d{11}$
JCB Card
^9[0-9]{15}$
KoreanLocalCard
^(6304|6706|6709|6771)[0-9]{12,15}$
Laser Card
^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$
Maestro Card
5[1-5][0-9]{14}$
Mastercard
Solo Card
Switch Card
^(62[0-9]{14,17})$
Union Pay Card
4[0-9]{12}(?:[0-9]{3})?$
Visa Card
^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$
Visa Master Card
Foxmail.exe
Express Card
\logins.json
\signons.sqlite
WScript.Shell
Storage\
mail\
Data\
\Accounts\Account.rec0
\Account.stg
\AccCfg\Accounts.tdat
\Account.rec0
EnableSignature
PeriodicCheckTime
OutgoingServer
Application : FoxMail
nextId
encryptedUsername
logins
encryptedPassword
hostname
GMf
AppData
\Local State
LOCALAPPDATA
k_Ox[:
bin.base64
P)#m
8171626722:AAGIo9PvRpFrmWwamfv0SMURLy1PCYFG9a8
6542615755
KeyData
Application : NordVPN
POP3 User
Amex Card
^3[47][0-9]{13}$
Insta Payment Card
3[7][0-9]{13}$
OutgoingSSL
:3(
Total events
162
Read events
162
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6364
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
7120
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
7120
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
3040
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
92.123.104.32:443
www.bing.com
Akamai International B.V.
DE
whitelisted
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
1176
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.bing.com
  • 92.123.104.32
  • 92.123.104.34
  • 92.123.104.38
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
ocsp.digicert.com
  • 192.229.221.95
  • 184.30.131.245
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.4
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.0
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info