Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
23/10/2023, 18:12
General
-
Target
NEAS.2023-09-08_88ca5f2b3e4f927a229d341dc604bd54_darkside_JC.exe
-
Size
148KB
-
MD5
88ca5f2b3e4f927a229d341dc604bd54
-
SHA1
ac23b8d5ec5b795298b228984b406741d1d11b96
-
SHA256
2c7e0ce7343edf97cf8ce2a5cff6a0c0d981ddb73f29dae9664ddfccdc7fdafd
-
SHA512
9694d5f34253203cb8a460c29d28762230e78696ee55e612e9b38fe9a3e5ef994c513033485e770c00c33870ee0894a8fbc735d8c33f1b8c80ed7e95aa0f6ff7
-
SSDEEP
1536:tzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDMVzX3Z5iU777LquNfWV6THFHGK:+qJogYkcSNm9V7DMVL577fWg7FHGKTT
Malware Config
Extracted
C:\kKxr0ztPS.README.txt
https://t.me/blackout_supp
https://tox.chat/clients.html
Signatures
-
Renames multiple (554) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_88ca5f2b3e4f927a229d341dc604bd54_darkside_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_88ca5f2b3e4f927a229d341dc604bd54_darkside_JC.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\AD72.tmp"C:\ProgramData\AD72.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{B95D6F04-9277-4FDB-82CA-8EB5AECC5758}.xps" 1334255852922100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
129B
MD587109312a3c88a50ca9cb785043bcea9
SHA19cc305894cba2f43fc1b2d6071afb8169ef63142
SHA256c68bb0a19b6601fcbc4e765100eaeab3111391e876f267b4969ce2d782ca6514
SHA5120397040c397c6377917402937de4e8bf6523af1dfb8edc41a8a96f22f6bbbc129381670e50da325098b2429d193ee3d18bb6e3f2d332c0cbbc63906885e56f7e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
148KB
MD5b3175c9d809c347f19de3d4b46b866a2
SHA175008db06ab631bf97b163c8f73c4b027e1598e4
SHA2569cd57dd68acb6865144c6c131449c3336effb8e8e23e676371ae33f0ca2d6a8c
SHA51282589567ffb9d42189ea3cb20f1481183245488acacd6f45c953158fb544ca7c398c32df22d1e5eb967eb788770e57d6b30ea7553127386989db0550a0dd470f
-
Filesize
4KB
MD52d9f0f204eb525a42d10c2f9aeabf3b6
SHA1337e067f21bfef9f1223398b1723f07121f80bc1
SHA25657aec89d54977852915e0c749384271e1703156e914f71ba5a43eb7ebcc74a63
SHA51203eb9ea77d569a7dfeda46399bfa875a6005d2ba4ad44565ed88e0d1ffae73e3f38d94c5e89d52147c1120b31b38bb2b3f1e59726399b40779de72ba01a5ce4b
-
Filesize
2KB
MD5ca4fa3cc19284229c7a0d15d7947e3a7
SHA1cf573ee98fac8e33f9f53df89e087cad57bd174b
SHA25650a9e93b25f611f0b44274707e88b6d4aaf31e3b914a9bb618e35e4401ca83fe
SHA512cdfa74c9b20cadf7a75fda589752409027fabee49218bb68c543319b0c863e89e7db5405e6de00156f11c62d648f9d9d63789f541670e4642d9b59c30090f17b
-
Filesize
129B
MD5f4f93c7f171adaba6b7821e0534cafc9
SHA15b52bf7b5dc1c01e556776b356e5e3b87c8177ec
SHA256750c9aaf640b2ea1e3d61ee522e7d0a911ba0c72aa1765313f96d0437b7f9a4e
SHA512acc4b78f320406d644375b85135fa3e03541a4f2a71d32911ce442bd7a4a655547398bc51c2612b8f945cccf936cc35640afab458bcae60694a293e2810ed0bb
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB