Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2024 11:55
Behavioral task
behavioral1
Sample
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe
-
Size
146KB
-
MD5
e18ad7e7c1f3b86250beb3deabe9ce03
-
SHA1
2e30f346324ab4dd95daa113165587fb6b9e817a
-
SHA256
71895d170c7578dc8d5dba7e3136e514d8c42f502e5dc88aff532f11dac01f32
-
SHA512
1d8f34afcb45ebbecfb9b07dc395ddabecbd9060c59bcf817386d52a37484d77b09ab818ab1c941df7b9b504c3cab1e962e88709d6c6aeb9cbc37ee5f1d2aebd
-
SSDEEP
1536:5zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDiaaL+6VfaU1QezJDX5EHRBiZ1B:CqJogYkcSNm9V7DnefaU1QwJ5CR29T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
3D81.tmppid Process 4956 3D81.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-983843758-932321429-1636175382-1000\desktop.ini 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-983843758-932321429-1636175382-1000\desktop.ini 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\aPj8kPbya.bmp" 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\aPj8kPbya.bmp" 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
3D81.tmppid Process 4956 3D81.tmp 4956 3D81.tmp 4956 3D81.tmp 4956 3D81.tmp 4956 3D81.tmp 4956 3D81.tmp -
Modifies Control Panel 2 IoCs
Processes:
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya\DefaultIcon 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya\DefaultIcon\ = "C:\\ProgramData\\aPj8kPbya.ico" 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.aPj8kPbya 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aPj8kPbya\ = "aPj8kPbya" 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exepid Process 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeDebugPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: 36 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeImpersonatePrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeIncBasePriorityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeIncreaseQuotaPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: 33 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeManageVolumePrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeProfSingleProcessPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeRestorePrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSystemProfilePrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeTakeOwnershipPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeShutdownPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeDebugPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeBackupPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe Token: SeSecurityPrivilege 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exedescription pid Process procid_target PID 3236 wrote to memory of 4956 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 93 PID 3236 wrote to memory of 4956 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 93 PID 3236 wrote to memory of 4956 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 93 PID 3236 wrote to memory of 4956 3236 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\ProgramData\3D81.tmp"C:\ProgramData\3D81.tmp"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5e39d9a4758dc61d72f45e16a6951ce64
SHA16c18918498eba333e50847a6ccc88ccdcb2130fc
SHA256628465cbe9057a2d660dc47e73b4751cf51d63547d00ca49d678afa70355ba9d
SHA512506c057f5765012bd63979346ba376cc0d5d0c5d064c28fe2fa944ad078388eef3309afa12ae284dd33c69b058896457f107c9b7a41128e6843719cbbcd46362
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
401B
MD5a4a44c115f77fb6a8b86ce357845c504
SHA15346db5cc94ffe243fce3ccbd74879580c9e49bf
SHA2568ee6de1ebdc07b5c71483aac95b9deb667b0413c8c30a902e74df99a6bbe1eeb
SHA512af02e93763b99d2b5e88580e0fec04ce02e7b88c76c40baf468ae60e57935fee4f38b28ea3660661ae80207ddf1a73e636d0567edc827c842d782627b39b18b2
-
Filesize
129B
MD53bf8fa8ead50377a192e95c63da67d7e
SHA195a74f5f522ace4d145ff8946e644a488709abcd
SHA256116eac0a9d6e707fbf246a1ff7285fed6047862a772f70b03c6ec585c3c56f0b
SHA5122f2aca3457be17eb04dc83bec7a0ab8244a8cdf2ce9fcf8064c176d50b50c980e969417d783f9c3df023785a69d05711f2847163b10c9dc41e3a78285b69ea04