Analysis

  • max time kernel
    93s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2025, 05:16

General

  • Target

    MAR10.2025Order.pdf.exe

  • Size

    774KB

  • MD5

    c8da5cab3dd5285bcf8fbc5f77b1415a

  • SHA1

    9132caf4f0c3030f044839c722c55da44b892ffc

  • SHA256

    80742a25d1550dd0f7ccb299672a5d9de889f57c0e53e3e8eea0e50d6b7ae33b

  • SHA512

    292dc2ed09534add4f7c7057549c05007bf374a89dde107001adc3b943a4d7d3e3b5c90f8f09c46b311905c6a08120ed6b400df1cc56fcc4060ca860a733a7e0

  • SSDEEP

    24576:kRFBUYxQiLg5N2Gzjne3qYHKKdskZtBCbEs:kRFjxQiLScGvnEqWs8zCn

Malware Config

Extracted

Family

darkcloud

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.kashmirestore.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    c%P+6,(]YFvP

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Darkcloud family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MAR10.2025Order.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\MAR10.2025Order.pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MAR10.2025Order.pdf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:412
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sricWCFHDbf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2168
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sricWCFHDbf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE5EB.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:628
    • C:\Users\Admin\AppData\Local\Temp\MAR10.2025Order.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\MAR10.2025Order.pdf.exe"
      2⤵
        PID:2644
      • C:\Users\Admin\AppData\Local\Temp\MAR10.2025Order.pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\MAR10.2025Order.pdf.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4536

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      b5b134afc341aee8eb6539563058515a

      SHA1

      fd10166965c4cb0330e5d08f925a53ef85747e77

      SHA256

      76814bc8582da0833b4d82d0c8fec500b795dd5662a751eaf8569e06949fd970

      SHA512

      83ea13a64c2c3342cebb8ad2182ee7d5e401e5564d1c28f0d0521743b8ac80bf33b7a7afafe6e2296a0a6113031eaf89306e9c82c5b31d074ca3fa3ed44ae4b3

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sfsdtj5c.0sc.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpE5EB.tmp

      Filesize

      1KB

      MD5

      bedbe85bdf3e40d124f3016230275d81

      SHA1

      0012b3c35a0db63d0aa82ce139e02ae12f29417f

      SHA256

      dfe71889852820bf38c664e29d1119f661e63a8ee7d078aa7fb035c23f230ecd

      SHA512

      37f35f1534d22b4e723cb38daf5fd0b7f5dd280cea1cc1e55e44ba520051ee58418b0077d94622fbd688b4dcaca941f63f981d352c7a93a597f205cc61c7abe7

    • memory/412-16-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/412-74-0x0000000075980000-0x00000000759CC000-memory.dmp

      Filesize

      304KB

    • memory/412-96-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/412-93-0x0000000007070000-0x0000000007078000-memory.dmp

      Filesize

      32KB

    • memory/412-92-0x0000000007090000-0x00000000070AA000-memory.dmp

      Filesize

      104KB

    • memory/412-91-0x0000000006F90000-0x0000000006FA4000-memory.dmp

      Filesize

      80KB

    • memory/412-90-0x0000000006F80000-0x0000000006F8E000-memory.dmp

      Filesize

      56KB

    • memory/412-15-0x0000000000CA0000-0x0000000000CD6000-memory.dmp

      Filesize

      216KB

    • memory/412-89-0x0000000006F50000-0x0000000006F61000-memory.dmp

      Filesize

      68KB

    • memory/412-17-0x0000000004E20000-0x0000000005448000-memory.dmp

      Filesize

      6.2MB

    • memory/412-18-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/412-85-0x0000000007390000-0x0000000007A0A000-memory.dmp

      Filesize

      6.5MB

    • memory/412-86-0x0000000006D50000-0x0000000006D6A000-memory.dmp

      Filesize

      104KB

    • memory/412-84-0x0000000006BF0000-0x0000000006C93000-memory.dmp

      Filesize

      652KB

    • memory/412-25-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2168-19-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2168-24-0x0000000005970000-0x00000000059D6000-memory.dmp

      Filesize

      408KB

    • memory/2168-29-0x00000000059E0000-0x0000000005D34000-memory.dmp

      Filesize

      3.3MB

    • memory/2168-28-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2168-100-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2168-23-0x0000000005880000-0x00000000058E6000-memory.dmp

      Filesize

      408KB

    • memory/2168-88-0x0000000007570000-0x0000000007606000-memory.dmp

      Filesize

      600KB

    • memory/2168-20-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2168-22-0x0000000005010000-0x0000000005032000-memory.dmp

      Filesize

      136KB

    • memory/2168-60-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

      Filesize

      120KB

    • memory/2168-61-0x0000000006050000-0x000000000609C000-memory.dmp

      Filesize

      304KB

    • memory/2168-63-0x0000000075980000-0x00000000759CC000-memory.dmp

      Filesize

      304KB

    • memory/2168-62-0x0000000007180000-0x00000000071B2000-memory.dmp

      Filesize

      200KB

    • memory/2168-73-0x0000000007140000-0x000000000715E000-memory.dmp

      Filesize

      120KB

    • memory/2168-87-0x0000000007360000-0x000000000736A000-memory.dmp

      Filesize

      40KB

    • memory/3380-4-0x0000000005330000-0x000000000533A000-memory.dmp

      Filesize

      40KB

    • memory/3380-9-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3380-3-0x0000000005370000-0x0000000005402000-memory.dmp

      Filesize

      584KB

    • memory/3380-50-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3380-6-0x00000000750F0000-0x00000000758A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3380-0-0x00000000750FE000-0x00000000750FF000-memory.dmp

      Filesize

      4KB

    • memory/3380-10-0x00000000067E0000-0x0000000006886000-memory.dmp

      Filesize

      664KB

    • memory/3380-1-0x0000000000A00000-0x0000000000AC6000-memory.dmp

      Filesize

      792KB

    • memory/3380-8-0x00000000750FE000-0x00000000750FF000-memory.dmp

      Filesize

      4KB

    • memory/3380-7-0x0000000005530000-0x0000000005540000-memory.dmp

      Filesize

      64KB

    • memory/3380-5-0x0000000005660000-0x00000000056FC000-memory.dmp

      Filesize

      624KB

    • memory/3380-2-0x0000000005A60000-0x0000000006004000-memory.dmp

      Filesize

      5.6MB

    • memory/4536-27-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB

    • memory/4536-26-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB