Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 09:33
General
- Target Product Specification.pdf.exe
- Size 955KB
- Sample261026-ljag7awsdv
- SHA256 5e4e9ba71438f89d11ccd7318fc5bb2f45999c18b08fe62d987dcc045acbc4e8
Malware Config
Extracted
-
darkcloud
-
5.0
Signatures
- Family: DarkCloud
An information stealer written in Visual Basic.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Product Specification.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Product Specification.pdf.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Product Specification.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Product Specification.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Product Specification.pdf.exe"2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_r3i0umxw.1as.psm1
memory/3376-32-0x0000000006310000-0x000000000635C000-memory.dmp
memory/3376-46-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/3376-56-0x0000000074660000-0x0000000074E1C000-memory.dmp
memory/3376-54-0x0000000007840000-0x00000000078D6000-memory.dmp
memory/3376-53-0x0000000007640000-0x000000000764A000-memory.dmp
memory/3376-52-0x00000000075D0000-0x00000000075EA000-memory.dmp
memory/3376-51-0x0000000007C10000-0x000000000828C000-memory.dmp
memory/3376-50-0x0000000007470000-0x0000000007513000-memory.dmp
memory/3376-49-0x0000000006820000-0x0000000006840000-memory.dmp
memory/3376-45-0x0000000007200000-0x0000000007236000-memory.dmp
memory/3376-31-0x0000000005EE0000-0x0000000005EFE000-memory.dmp
memory/3376-30-0x0000000005F60000-0x00000000062BB000-memory.dmp
memory/3376-28-0x0000000005CA0000-0x0000000005D06000-memory.dmp
memory/3376-16-0x0000000004D80000-0x0000000004DB6000-memory.dmp
memory/3376-29-0x0000000005D10000-0x0000000005D76000-memory.dmp
memory/3376-19-0x0000000005580000-0x0000000005BCA000-memory.dmp
memory/3376-18-0x0000000074660000-0x0000000074E1C000-memory.dmp
memory/3376-21-0x0000000074660000-0x0000000074E1C000-memory.dmp
memory/3376-27-0x0000000005C00000-0x0000000005C22000-memory.dmp
memory/3376-22-0x0000000074660000-0x0000000074E1C000-memory.dmp
memory/3492-1-0x0000000000620000-0x0000000000716000-memory.dmp
memory/3492-9-0x0000000074660000-0x0000000074E1C000-memory.dmp
memory/3492-3-0x00000000052C0000-0x0000000005352000-memory.dmp
memory/3492-4-0x0000000005240000-0x000000000524A000-memory.dmp
memory/3492-12-0x0000000008230000-0x00000000086FC000-memory.dmp
memory/3492-11-0x0000000007D00000-0x000000000822C000-memory.dmp
memory/3492-0-0x0000000074672000-0x0000000074673000-memory.dmp
memory/3492-10-0x0000000007710000-0x00000000077CE000-memory.dmp
memory/3492-2-0x0000000005880000-0x0000000005E3A000-memory.dmp
memory/3492-24-0x0000000074660000-0x0000000074E1C000-memory.dmp
memory/3492-5-0x0000000005400000-0x000000000549C000-memory.dmp
memory/3492-8-0x0000000074672000-0x0000000074673000-memory.dmp
memory/3492-7-0x00000000053C0000-0x00000000053D2000-memory.dmp
memory/3492-6-0x0000000074660000-0x0000000074E1C000-memory.dmp
memory/4324-15-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4324-13-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4324-23-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4324-57-0x0000000000400000-0x000000000047B000-memory.dmp