Overview

overview

10

Static

static

DArkS.bin.exe

windows7_x64

10

DArkS.bin.exe

windows10_x64

10

Analysis

  • max time kernel
    46s
  • max time network
    80s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    08-07-2021 08:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DArkS.bin.exe

  • Size

    61KB

  • MD5

    c8873191fe599cde49491443b47eb036

  • SHA1

    b11def82d23f4c4883cf13b41de4cc2c8c5cc92f

  • SHA256

    b565e9266717161163e884793dc1004f9f2ca94ab0533df9c167d5d188cebf2f

  • SHA512

    2652dc435b148ac4af0dbb9edd8ceab711a540f4e6459fa78b95a5627a8e73e7bd27b601148262db0596699682a8a2e193dc3b2ba0bb9312cdb79c0563aff974

Score
10/10
darksideransomware

Malware Config

Extracted

Path

\Device\HarddiskVolume1\\README.70d4d153.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/MYM57PZKKZKVJWS2PAFUZ4ZUZRK3JW4O1VQBMFON3RZIMKZ9CGVFLH2HV089EGT5 When you open our website, put the following data in the input form: Key: NAQs1URQJY1VVwfwuJsJW1cinECoSP8W4srcHTFIO0vJ1hJqEavnyppmYVng86GSskYd56DZQnV2Ac3Fmsv7Hhj4j7lpNZrJIdFqTMvEtchexyln4phVDQg5Tt9feJwdsGq5njUDCCJtmJUmWrIqR2bewAir5GxMOfJ3P4srcUgHjH5BRdLuNNp0LDtbQEEjHdyRr9yoljknyF3OHqQUUh6mOb7jpPXpBCOidIbHIrrnYeHM8Sq4hVodJWBzROt0wgSHvLkeabGAsxyJQz1ZYrvlmGK8KJ6w6BGbh1QzmDpiEycPL5vQeC4F8zfkLbeg5dSY4wktSSES9SdvcfzIwwt4ogRQhebKyvXyRjhOSmQfVUznGMeyNh2axiVG4wUhsE6V2rD85n7SJSsIpdXQqgD9q7bRmjjzXLQaT1myrcqrLqKAfZaSnm7HnAcPKlYTx3eBD4rTtM2ExUf9Ag91R61hOAA134Alx39Kcbns0nHXdmkRcMrn6Z3ivZ4YIE1lhTPE9uItg3wp6vRiVPVF7V96viOqGnOsNeCkRJ3XQEE8vKZrtiogDSB !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/MYM57PZKKZKVJWS2PAFUZ4ZUZRK3JW4O1VQBMFON3RZIMKZ9CGVFLH2HV089EGT5

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside
  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 62 IoCs
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DArkS.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\DArkS.bin.exe"
    1⤵
      PID:808
    • C:\Users\Admin\AppData\Local\Temp\DArkS.bin.exe
      "C:\Users\Admin\AppData\Local\Temp\DArkS.bin.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\DArkS.bin.exe
        "C:\Users\Admin\AppData\Local\Temp\DArkS.bin.exe"
        2⤵
        • Enumerates connected drives
        • Sets desktop wallpaper using registry
        • Modifies Control Panel
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Users\Admin\AppData\Local\Temp\darks.bin.exe
          C:\Users\Admin\AppData\Local\Temp\darks.bin.exe -work worker0 job0-3304
          3⤵
          • Modifies extensions of user files
          • Drops startup file
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1356
        • C:\Users\Admin\AppData\Local\Temp\darks.bin.exe
          C:\Users\Admin\AppData\Local\Temp\darks.bin.exe -work worker1 job1-3304
          3⤵
          • Enumerates connected drives
          PID:2172
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3108
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:368
    • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
      "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4068
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
      1⤵
      • Drops file in Windows directory
      PID:3124

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\LOGS.70d4d153\LOG.70d4d153.PID-0.TXT
      MD5

      4cb1a04be4a8f158bd30c80da609d4b3

      SHA1

      23e93b8549fcd653585aedf30504b652fc827362

      SHA256

      9bdf6132b8c630cd38346765661f64398f4744a252640b9227e5257c03ceedb0

      SHA512

      29b3b9ad8e73fad3713184edb460530e435a9340893dea56524f6390570f91e76dfa5783bd5f177f4733dba9c8ae87c13a534038e1d6242859483ba9e664d9a6

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\LOGS.70d4d153\LOG.70d4d153.PID-0.TXT
      MD5

      4cb1a04be4a8f158bd30c80da609d4b3

      SHA1

      23e93b8549fcd653585aedf30504b652fc827362

      SHA256

      9bdf6132b8c630cd38346765661f64398f4744a252640b9227e5257c03ceedb0

      SHA512

      29b3b9ad8e73fad3713184edb460530e435a9340893dea56524f6390570f91e76dfa5783bd5f177f4733dba9c8ae87c13a534038e1d6242859483ba9e664d9a6

      Download Submit
    • memory/1356-117-0x0000000000000000-mapping.dmp
      Download
    • memory/2172-118-0x0000000000000000-mapping.dmp
      Download
    • memory/3124-119-0x00000198726A0000-0x00000198726B0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3124-120-0x0000019872A70000-0x0000019872A80000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3304-116-0x0000000000000000-mapping.dmp
      Download