Analysis
- max time kernel
104s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
19/06/2025, 07:00
General
- Target HSBC_Payment_slip_for Inv pendiente-0023.exe
- Size 1.1MB
- Sample250619-hs3csaar2x
- SHA256 d24f280b413e7e170bdc29ba7bfaa7a3d221e582204c331803a9fbba64ff7d13
Malware Config
Signatures
- DarkCloud
An information stealer written in Visual Basic.
- Darkcloud family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HSBC_Payment_slip_for Inv pendiente-0023.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_Payment_slip_for Inv pendiente-0023.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tmYCDy.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tmYCDy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp98F4.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\HSBC_Payment_slip_for Inv pendiente-0023.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_Payment_slip_for Inv pendiente-0023.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ljip2cvz.p5r.ps1
tmp98F4.tmp
memory/1404-71-0x0000000007080000-0x0000000007091000-memory.dmp
memory/1404-34-0x0000000005410000-0x0000000005432000-memory.dmp
memory/1404-73-0x00000000070C0000-0x00000000070D4000-memory.dmp
memory/1404-72-0x00000000070B0000-0x00000000070BE000-memory.dmp
memory/1404-54-0x0000000006110000-0x0000000006142000-memory.dmp
memory/1404-70-0x0000000007100000-0x0000000007196000-memory.dmp
memory/1404-69-0x0000000006EF0000-0x0000000006EFA000-memory.dmp
memory/1404-68-0x0000000006E80000-0x0000000006E9A000-memory.dmp
memory/1404-67-0x0000000007500000-0x0000000007B7A000-memory.dmp
memory/1404-15-0x0000000002250000-0x0000000002286000-memory.dmp
memory/1404-75-0x00000000071A0000-0x00000000071A8000-memory.dmp
memory/1404-17-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1404-74-0x00000000071C0000-0x00000000071DA000-memory.dmp
memory/1404-66-0x0000000006DD0000-0x0000000006E73000-memory.dmp
memory/1404-18-0x0000000004CC0000-0x00000000052E8000-memory.dmp
memory/1404-20-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1404-65-0x0000000006150000-0x000000000616E000-memory.dmp
memory/1404-78-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1404-55-0x000000006FEC0000-0x000000006FF0C000-memory.dmp
memory/1404-36-0x0000000005520000-0x0000000005586000-memory.dmp
memory/1404-35-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/1404-19-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1404-41-0x0000000005590000-0x00000000058E4000-memory.dmp
memory/1404-52-0x0000000005B50000-0x0000000005B6E000-memory.dmp
memory/1404-53-0x0000000005B90000-0x0000000005BDC000-memory.dmp
memory/2212-10-0x0000000006180000-0x0000000006252000-memory.dmp
memory/2212-7-0x00000000053E0000-0x00000000053F4000-memory.dmp
memory/2212-1-0x00000000003C0000-0x00000000004D2000-memory.dmp
memory/2212-2-0x00000000054B0000-0x0000000005A54000-memory.dmp
memory/2212-0-0x000000007447E000-0x000000007447F000-memory.dmp
memory/2212-9-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/2212-8-0x000000007447E000-0x000000007447F000-memory.dmp
memory/2212-30-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/2212-5-0x00000000051A0000-0x000000000523C000-memory.dmp
memory/2212-6-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/2212-4-0x0000000004E80000-0x0000000004E8A000-memory.dmp
memory/2212-3-0x0000000004F00000-0x0000000004F92000-memory.dmp
memory/5520-21-0x0000000000400000-0x0000000000487000-memory.dmp
memory/5520-24-0x0000000000400000-0x0000000000487000-memory.dmp
memory/5520-79-0x0000000000400000-0x0000000000487000-memory.dmp