Analysis
-
max time kernel
88s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 08:35
Behavioral task
behavioral1
Sample
2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe
-
Size
159KB
-
MD5
84fcdeae85233ce2622f77de22cc1e8a
-
SHA1
94f387bcfe86ebc2766b54aefc786e81c7ba6cd0
-
SHA256
181b448f5249d5b7bbf247ef09cb2f82a637f6eee6e806894c8a39c7ec72c2bd
-
SHA512
8bd3da16a9fa891f4c93d8c976d1364402c933ccbdebb06f5703b2a5fd41c86296b749cfaaf03a6c378facbd7f31e9057442f925e3b1d5bf758cffb9a5c4a1cf
-
SSDEEP
3072:PuJ9OlKolUa1U197bzhVsmftsp1WzS4PBtOhTgwCfNffHtW8mDvd:Pufj0zi1dNVsmfto4245tOheHtnmTd
Malware Config
Extracted
C:\Users\6ffU5lk5e.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (132) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 54D7.tmp -
Deletes itself 1 IoCs
pid Process 2404 54D7.tmp -
Executes dropped EXE 1 IoCs
pid Process 2404 54D7.tmp -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1168293393-3419776239-306423207-1000\desktop.ini 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1168293393-3419776239-306423207-1000\desktop.ini 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\6ffU5lk5e.bmp" 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\6ffU5lk5e.bmp" 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\Desktop 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6ffU5lk5e\DefaultIcon 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6ffU5lk5e 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6ffU5lk5e\DefaultIcon\ = "C:\\ProgramData\\6ffU5lk5e.ico" 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.6ffU5lk5e 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.6ffU5lk5e\ = "6ffU5lk5e" 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp 2404 54D7.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeDebugPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: 36 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeImpersonatePrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeIncBasePriorityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeIncreaseQuotaPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: 33 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeManageVolumePrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeProfSingleProcessPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeRestorePrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSystemProfilePrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeTakeOwnershipPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeShutdownPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeDebugPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeBackupPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe Token: SeSecurityPrivilege 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 820 wrote to memory of 2404 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 93 PID 820 wrote to memory of 2404 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 93 PID 820 wrote to memory of 2404 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 93 PID 820 wrote to memory of 2404 820 2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe 93 PID 2404 wrote to memory of 4168 2404 54D7.tmp 98 PID 2404 wrote to memory of 4168 2404 54D7.tmp 98 PID 2404 wrote to memory of 4168 2404 54D7.tmp 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_84fcdeae85233ce2622f77de22cc1e8a_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820 -
C:\ProgramData\54D7.tmp"C:\ProgramData\54D7.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\54D7.tmp >> NUL3⤵PID:4168
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5f0e00f1dc8fa6d5c27552ad6748543ba
SHA19bc59d894ca66eeb84cf007b46d24cc523425732
SHA2567b4a0ed473b2b06986bc240ba8c314d63aa6fed763ac4612b5fb72df083902bc
SHA512b3af863f16dc2b903c1ec42dd9cc9ba73fb0e77d3ccd3fc34e254d5f3e8fcef438308b1bd2da2e8740cea7b966b0c9805349c7efb2e7fbcd6b940aa51190624e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
10KB
MD597205f04a35fc35218f46e30461253bd
SHA198a444e794aca918804689f22ec9cb75547cbfdf
SHA2561e79bdecc0aba52268271e76e859aa1ebc041631e4848ee1729608d5902e47b1
SHA5121d3e36d4c251fd6bd1c87859be714869cf99f49e67d027e78a31d9c40dbaedfc2b434f96a88e82ab568e8b332cfb198e3994d7c477d42948d417d5586bcd8ad6
-
Filesize
159KB
MD5567c6ebecf3889a712d0ad4d82f7867c
SHA1f9c13f48215182ab92b0e10b6dd4a985bd4eb176
SHA256626ef0a6e4c6b2758629bb8b43cd948dffa89791962e39bba16c299b86c9fa94
SHA5127fbae01a569d875c087fba80420951b6d6147ef8f7e257c9edd5fdba0532eed681685c8b27001721af6ec425393d88033118023400ec5a9acfb81cfad281639d
-
Filesize
129B
MD52b7fbfd3ed46e680a20d52af2d797689
SHA17382fe4a0268cb32e4b9d0bdaa0b6bbb00796a78
SHA256a24b489384758f9b2321680801f4c8fd40f74e5be997fbc3c8a5927daf32e72f
SHA512f50e95c183b1d72bf54b12629b27a4e7b09b2407a5c6ee901a95ed0c015f275dcde412b6cbc98890a6b29f7a32978731d37bcee901cba1b7fc6535696a7a5cc6