Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/03/2025, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe
Resource
win7-20240903-en
General
-
Target
f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe
-
Size
821KB
-
MD5
dd6e3f2c8adb69c1572d43235a7b530f
-
SHA1
f73dd93046ad35a21a7c5f3a210f09e328a054fc
-
SHA256
f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6
-
SHA512
d95d035bf78c97de1e5e21291d9e0d163acbbb47742a9a14e5422e21131d2e3576a7892cfd75467e36981f22b00e13dbd1bf7974e1caa61c2717d99f0f09c172
-
SSDEEP
24576:FM02MZV6XHcbMqZYEtok6s2r1gBT7mSi9oSv:FVO8bxYMo7r1YHmBoS
Malware Config
Extracted
darkcloud
Protocol: ftp- Host:
ftp.condormalta.com - Port:
21 - Username:
[email protected] - Password:
~N#]]bSO$0-R
Signatures
-
Darkcloud family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2916 powershell.exe 2604 powershell.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000600000001873d-36.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2136 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2668 set thread context of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 -
resource yara_rule behavioral1/files/0x000600000001873d-36.dat upx behavioral1/memory/2136-39-0x0000000074BF0000-0x0000000074C59000-memory.dmp upx behavioral1/memory/2136-41-0x0000000074BF0000-0x0000000074C59000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2712 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2916 powershell.exe 2604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2916 powershell.exe Token: SeDebugPrivilege 2604 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2136 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2916 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 31 PID 2668 wrote to memory of 2916 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 31 PID 2668 wrote to memory of 2916 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 31 PID 2668 wrote to memory of 2916 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 31 PID 2668 wrote to memory of 2604 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 33 PID 2668 wrote to memory of 2604 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 33 PID 2668 wrote to memory of 2604 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 33 PID 2668 wrote to memory of 2604 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 33 PID 2668 wrote to memory of 2712 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 35 PID 2668 wrote to memory of 2712 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 35 PID 2668 wrote to memory of 2712 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 35 PID 2668 wrote to memory of 2712 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 35 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37 PID 2668 wrote to memory of 2136 2668 f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe"C:\Users\Admin\AppData\Local\Temp\f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xZLeCXkVsspC.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xZLeCXkVsspC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3997.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe"C:\Users\Admin\AppData\Local\Temp\f18d276ce3ec088f6d446e409489bad5c9b613d6c1f10a6538724749c7cf2af6.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51e5c6d1589b2943c63546398fa646b91
SHA19381adbd78a99c41b08a72eaecb318d721750877
SHA256fb42d38147364520294356c15a3d1612870962399f50377fdb39e7931372607a
SHA5120bb334417f1219ce7017d44afd0f74b8fac2804db38c7643e43cc8edc2aa19de1954040b98f944f1a51f1a32564ba6831ca9d5114a3d70089d2bfc058e193364
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GOT0GQ3D8DC27I3DYOXC.temp
Filesize7KB
MD5d61ecdbce40ba0f25d348ab53305ee5e
SHA14201ed3b4a159a9432a08643e066b502be0a182e
SHA256bca8af958655863d77771afa63fa9b076b04f1389b4a6980e18bdb83ffdb3631
SHA512850e9ea24ff1f5ece6602557f86509f2624c85212d4020bf77d1dff666697a0fd1eedb80d40d8ac62090c8f3442ea8e120b16887b91f957b45ba8aa05b1ab123
-
Filesize
161KB
MD5073a17b6cfb1112c6c838b2fba06a657
SHA1a54bb22489eaa8c52eb3e512aee522320530b0be
SHA256dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab
SHA5125bc8307350bd8ba09fa9eedddc62f1dba65db62eb09ae64e0adff4dfad0937dbec5b621f294f5980bf77033faac3bfe200945c0280606915ee9a82d34a003b9e