Unveiling a New DarkCloud Variant: A SOC Analyst’s Deep Dive

Executive Summary

In early July 2025, FortiGuard Labs identified a new variant of the DarkCloud malware being distributed via phishing emails. This campaign begins with a RAR archive attachment containing a malicious JavaScript file. Once executed, the script leverages PowerShell to download a disguised .NET DLL, which then deploys the final DarkCloud payload via process hollowing into MSBuild.exe. The malware is designed to harvest credentials, financial data, browser information, and email contacts, exfiltrating stolen data over SMTP. This analysis breaks down the infection chain, payload behavior, and offers detection strategies for defenders.

Background

DarkCloud is a Windows-based information stealer first identified in 2022. This new variant continues its tradition of stealing sensitive data—including saved credentials, payment details, and contact lists—from infected systems. The campaign uses sophisticated techniques like fileless payload deployment, process hollowing, and anti-analysis checks to evade detection.

Infection Chain

The infection begins with a phishing email containing a RAR attachment named Quote #S_260627.RAR. Inside is a JavaScript file that, when executed, launches WScript.exe to run the script. The JavaScript decodes and executes a Base64-encoded PowerShell command, which downloads a JPEG file with an embedded .NET DLL. This DLL is loaded via reflection, establishing persistence and deploying the final DarkCloud payload.

Initialization via Phishing Email

The phishing email contains no body text—only a RAR attachment. Once opened, the victim sees a JavaScript file and may execute it, triggering the infection chain.

JavaScript & PowerShell Payload

The JavaScript is heavily obfuscated. It decodes and runs a PowerShell command that downloads a JPEG file from a remote URL. Hidden within this JPEG is an encrypted .NET DLL, which is extracted and loaded into memory using reflection.

Dissecting the .NET Module

The .NET DLL, masquerading as Microsoft.Win32.TaskScheduler, performs several critical actions:

• Persistence: Copies the JavaScript to a public folder and adds a Run registry key.
• Payload Retrieval: Decodes a Base64 string to form a URL from which it downloads a reversed PE file.
• Process Hollowing: Injects the DarkCloud payload into a newly created MSBuild.exe process using APIs like CreateProcess, VirtualAllocEx, and ResumeThread.

A Closer Look at the DarkCloud Payload

The final payload is written in VB6 and uses multiple timers to orchestrate its activities. Timer4 acts as the primary worker, executing key functions every 150 milliseconds.

Anti-Analysis Techniques

DarkCloud employs several anti-analysis measures:

• Encrypted Strings: Over 600 constant strings are encrypted and decrypted at runtime.
• Anti-Sandbox: Checks for user activity (keystrokes, mouse clicks) via GetAsyncKeyState to evade automated analysis environments.

Data Collection Capabilities

The malware harvests a wide range of sensitive information:

• System details (computer name, username, public IP)
• Browser credentials and payment data from Chrome, Edge, Firefox, and others
• Email contacts from clients like Thunderbird and Outlook
• Data from FTP clients, Adobe, Wireshark, and more

Stolen data is saved in local text files before exfiltration.

Data Exfiltration via SMTP

This variant uses SMTP to exfiltrate data. All related strings (SMTP server, credentials, recipient) are encrypted within the payload. The email subject includes victim identifiers like computer name and IP address.

How TechOwl FortiSIEM Detects This Attack

TechOwl’s FortiSIEM is configured to detect multiple stages of this attack using parsing, correlation rules, and log source integration. Below are key detection strategies:

Initial Access & Execution

• Phishing Email Detection: Monitor for emails with RAR attachments and suspicious subjects.
• JavaScript Execution: Look for WScript.exe spawning from email-related processes (e.g., Outlook).
• wineventid-4688 (Process Creation) with processName containing WScript.exe and command line referencing .js files.

PowerShell Activity

• Obfuscated PowerShell: Detect Base64-encoded PowerShell commands and hidden execution.
• Correlation rule: PowerShell -ExecutionPolicy Bypass or -ep bypass in command lines.
• Attributes: command, processName (powershell.exe).

Network Activity

• Suspicious Downloads: Detect HTTP requests to malicious URLs like hxxp://paste[.]ee.
• Use url attribute in web proxy logs.
• JPEG Download: Alert on downloads of JPEG files from uncommon domains.

Persistence & Payload Deployment

• Registry Modification: Monitor for auto-run entries under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
• Process Hollowing: Detect MSBuild.exe launched with unusual parent processes or memory allocation behavior.
• Correlate CreateProcess and VirtualAllocEx events via EDR or Sysmon logs.

Exfiltration

• SMTP Traffic: Detect outbound emails with attachments containing sensitive data.
• Monitor SMTP logs for known malicious domains or large attachments from unusual senders.

IOC-Based Detection

• Use hashes (e.g., 381AA445E173341F39E464E4F79B89C9ED058631BCBBB2792D9ECBDF9FFE027D) and URLs in watchlists.

TechOwl SOC Recommendations

1. User Awareness Training: Educate users on identifying phishing emails—especially those with unexpected attachments.
2. Application Control: Restrict execution of scripts (JS, PowerShell) from email and temp directories.
3. Endpoint Detection: Deploy EDR solutions to monitor for process hollowing and unusual MSBuild.exe activity.
4. Network Monitoring: Block connections to known malicious URLs and monitor SMTP traffic for exfiltration.
5. IOC Hunting: Incorporate provided hashes and URLs into threat intelligence platforms and SIEM watchlists.
6. Patch and Harden: Keep systems and applications updated to mitigate exploitation.

Conclusion

The new DarkCloud variant demonstrates advanced techniques to remain stealthy while exfiltrating valuable data. Through a multi-stage infection chain involving phishing, fileless payloads, and process hollowing, the attackers successfully bypass many traditional defenses. By leveraging FortiSIEM’s correlation capabilities and adopting proactive security measures, defenders can detect and mitigate this threat effectively.

Stay vigilant, and happy hunting.

—TechOwl SOC Team

1. Threat Hunting Queries (Attack-Specific)

SELECT phRecvTime, host, user, procName, command
FROM fsiem.events
WHERE eventType IN ('Win-Security-4688', 'Win-Sysmon-1-Create-Process')
AND LOWER(procName) LIKE '%powershell%'
AND (command REGEXP '(?i)-enc|base64|FromBase64String'
OR command LIKE '% -w hidden -noprofile -ep bypass -c %')
AND phRecvTime >= NOW() - INTERVAL '24' HOUR;

SELECT phRecvTime, host, user, procName, parentProcName, command
FROM fsiem.events
WHERE eventType IN ('Win-Security-4688', 'Win-Sysmon-1-Create-Process')
AND LOWER(parentProcName) IN ('wscript.exe', 'cscript.exe')
AND LOWER(procName) LIKE '%powershell%'
AND phRecvTime >= NOW() - INTERVAL '24' HOUR;

SELECT phRecvTime, host, user, registryKey, registryValue
FROM fsiem.events
WHERE eventType = 'Win-Registry-Event'
AND LOWER(registryKey) LIKE '%\\software\\microsoft\\windows\\currentversion\\run%'
AND (LOWER(registryValue) LIKE '%.js%' OR LOWER(registryValue) LIKE '%edriophthalma%')
AND phRecvTime >= NOW() - INTERVAL '7' DAY;

SELECT phRecvTime, host, user, destName, destIpAddr
FROM fsiem.events
WHERE eventType IN ('Win-DNS-260-Query-out', 'FortiGate-event-dns-query')
AND (destName LIKE '%paste.ee%' OR destName LIKE '%archive.org%')
AND phRecvTime >= NOW() - INTERVAL '24' HOUR;

SELECT phRecvTime, host, user, destIpAddr, fileName, subject
FROM fsiem.events
WHERE eventType = 'SMTP-Mail-Event'
AND (fileName LIKE '%.txt%' OR subject LIKE '%ThunderBirdContacts%'
OR subject LIKE '%163MailContacts%' OR subject LIKE '%OutlookContacts%')
AND phRecvTime >= NOW() - INTERVAL '24' HOUR;

SELECT phRecvTime, host, user, url, destFilePath, hash
FROM fsiem.events
WHERE eventType = 'HTTP-File-Download'
AND (url LIKE '%archive.org/download/universe%'
OR url LIKE '%paste.ee/d/0WhDakVP/0%')
AND phRecvTime >= NOW() - INTERVAL '24' HOUR;

2. IOC Extraction

Advanced Detection Queries

SELECT phRecvTime, host, user, procName, parentProcName, parentSrcFilePath
FROM fsiem.events
WHERE eventType IN ('Win-Security-4688', 'Win-Sysmon-1-Create-Process')
AND LOWER(procName) = 'msbuild.exe'
AND LOWER(parentProcName) NOT IN ('svchost.exe', 'explorer.exe', 'cmd.exe')
AND phRecvTime >= NOW() - INTERVAL '1' HOUR;

SELECT phRecvTime, host, user, procName, srcFilePath
FROM fsiem.events
WHERE eventType = 'File-Access'
AND (srcFilePath LIKE '%\\Login Data%'
OR srcFilePath LIKE '%\\Web Data%'
OR srcFilePath LIKE '%\\AppData%\\Google\\Chrome%'
OR srcFilePath LIKE '%\\AppData%\\Mozilla\\Firefox%')
AND phRecvTime >= NOW() - INTERVAL '1' HOUR;