Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-02-2024 11:55

General

  • Target

    2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe

  • Size

    146KB

  • MD5

    e18ad7e7c1f3b86250beb3deabe9ce03

  • SHA1

    2e30f346324ab4dd95daa113165587fb6b9e817a

  • SHA256

    71895d170c7578dc8d5dba7e3136e514d8c42f502e5dc88aff532f11dac01f32

  • SHA512

    1d8f34afcb45ebbecfb9b07dc395ddabecbd9060c59bcf817386d52a37484d77b09ab818ab1c941df7b9b504c3cab1e962e88709d6c6aeb9cbc37ee5f1d2aebd

  • SSDEEP

    1536:5zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDiaaL+6VfaU1QezJDX5EHRBiZ1B:CqJogYkcSNm9V7DnefaU1QwJ5CR29T

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\ProgramData\3D81.tmp
      "C:\ProgramData\3D81.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-983843758-932321429-1636175382-1000\BBBBBBBBBBB

    Filesize

    129B

    MD5

    e39d9a4758dc61d72f45e16a6951ce64

    SHA1

    6c18918498eba333e50847a6ccc88ccdcb2130fc

    SHA256

    628465cbe9057a2d660dc47e73b4751cf51d63547d00ca49d678afa70355ba9d

    SHA512

    506c057f5765012bd63979346ba376cc0d5d0c5d064c28fe2fa944ad078388eef3309afa12ae284dd33c69b058896457f107c9b7a41128e6843719cbbcd46362

  • C:\ProgramData\3D81.tmp

    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

  • C:\aPj8kPbya.README.txt

    Filesize

    401B

    MD5

    a4a44c115f77fb6a8b86ce357845c504

    SHA1

    5346db5cc94ffe243fce3ccbd74879580c9e49bf

    SHA256

    8ee6de1ebdc07b5c71483aac95b9deb667b0413c8c30a902e74df99a6bbe1eeb

    SHA512

    af02e93763b99d2b5e88580e0fec04ce02e7b88c76c40baf468ae60e57935fee4f38b28ea3660661ae80207ddf1a73e636d0567edc827c842d782627b39b18b2

  • F:\$RECYCLE.BIN\S-1-5-21-983843758-932321429-1636175382-1000\DDDDDDDDDDD

    Filesize

    129B

    MD5

    3bf8fa8ead50377a192e95c63da67d7e

    SHA1

    95a74f5f522ace4d145ff8946e644a488709abcd

    SHA256

    116eac0a9d6e707fbf246a1ff7285fed6047862a772f70b03c6ec585c3c56f0b

    SHA512

    2f2aca3457be17eb04dc83bec7a0ab8244a8cdf2ce9fcf8064c176d50b50c980e969417d783f9c3df023785a69d05711f2847163b10c9dc41e3a78285b69ea04

  • memory/3236-2724-0x0000000003070000-0x0000000003080000-memory.dmp

    Filesize

    64KB

  • memory/3236-2-0x0000000003070000-0x0000000003080000-memory.dmp

    Filesize

    64KB

  • memory/3236-2722-0x0000000003070000-0x0000000003080000-memory.dmp

    Filesize

    64KB

  • memory/3236-2723-0x0000000003070000-0x0000000003080000-memory.dmp

    Filesize

    64KB

  • memory/3236-0-0x0000000003070000-0x0000000003080000-memory.dmp

    Filesize

    64KB

  • memory/3236-1-0x0000000003070000-0x0000000003080000-memory.dmp

    Filesize

    64KB

  • memory/4956-2730-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

  • memory/4956-2731-0x0000000002670000-0x0000000002680000-memory.dmp

    Filesize

    64KB

  • memory/4956-2732-0x0000000002670000-0x0000000002680000-memory.dmp

    Filesize

    64KB

  • memory/4956-2733-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

  • memory/4956-2734-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

  • memory/4956-2735-0x0000000002670000-0x0000000002680000-memory.dmp

    Filesize

    64KB

  • memory/4956-2736-0x0000000002670000-0x0000000002680000-memory.dmp

    Filesize

    64KB