Analysis

  • max time kernel
    145s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-02-2024 11:40

General

  • Target

    2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe

  • Size

    146KB

  • MD5

    93ddced13de907d75d421aff8ce8cde3

  • SHA1

    11418c6c3c57ca52c975c2f4e844df24c635f35f

  • SHA256

    492ac25608dda01b3f776b46a7631bb8cd91a0ce0168931ec5bb9a846e702e39

  • SHA512

    77db1a1cb741c431f224f31cf6edec189c92b53185250f3b186bd6275fc1d09b6668fa593ae3b86db57dcb52bed247c17a747eaf02ced102293f8918a2d4d8f8

  • SSDEEP

    3072:v6glyuxE4GsUPnliByocWep+rpfbfiwxmcyF:v6gDBGpvEByocWe2pfbfiwzyF

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-17_93ddced13de907d75d421aff8ce8cde3_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:2924
    • C:\ProgramData\7928.tmp
      "C:\ProgramData\7928.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7928.tmp >> NUL
        3⤵
          PID:3452
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3888
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{FDF81851-6958-4B83-98C2-6935CE525A02}.xps" 133526436309430000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:3148

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-1497073144-2389943819-3385106915-1000\EEEEEEEEEEE

        Filesize

        129B

        MD5

        e633a46de62dd28ffbf848e4bcfc6f7b

        SHA1

        c7e6f5f1c943d70ffd8d707f3ff30a0fcea1d8d2

        SHA256

        4330bd5be3ba70b2f3880cb53ad9baf13d73685204282624e2a3b26b6ae1e65c

        SHA512

        2571879761ed84541cd482f6aaaffc9e9547489f002a61aeb2564938a48ed6966dec3702b2b4c79e7a3ccb2f857a8759f3c45345cf32d3b17f6f0ff1e1304165

      • C:\ProgramData\7928.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

        Filesize

        146KB

        MD5

        3d02434a08218c6b0e92670dcbce7cdb

        SHA1

        0292f36616d125c963471f9c72af02968ebd4a80

        SHA256

        b5dc750ead429c38001fe7cac358b7505610fa284804b12c8b98199f064aad93

        SHA512

        8a2cb1433b419dfe45cc3771c8d8830e55d373fbdd758cf52a84c5056b5cfd72ecadd6b88e54de96934c88021f89a19d3fffbb4312ed0105813ef24e8fcd7076

      • C:\Users\Admin\AppData\Local\Temp\{52B6603B-CC0A-417D-BD17-B6C1C66E85F8}

        Filesize

        4KB

        MD5

        fc00ca06f4f020f540712f0b612a26a6

        SHA1

        dd3b3652c559dd1d530810e6a2991a7c5a754c13

        SHA256

        27eb1e218c55693a332fd1872a6a192ea0ff75a58753661cbf1966cf7aa47b22

        SHA512

        853edcbd3633284ee1d438163a3971aad4459e9a5d58e606c77c57a04bcef301aabc5de676ce82c6783801c05018f5fe030a26076309cac07c69e73811fce2c9

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

        Filesize

        4KB

        MD5

        29ef6d10a574dc758dfc5a7cb27ce356

        SHA1

        581a0031b4b6e640b9a49253b1f88346b4707cd7

        SHA256

        3ef305333d62ef29db38d8858e9f612d122e194b089d15231305e2282620edf4

        SHA512

        1fe12ae0857cd707a4f2d97df0ea76a6cad1179525b74c0d7f3d9d6d3bd44a0fd08658cf91a415eba49225672c54548e59a2f16fead2731a03c5141b9a9d832a

      • C:\xy5yyVMdq.README.txt

        Filesize

        658B

        MD5

        616a27a1516d0e2c6596bd33f133a2a4

        SHA1

        324dd40d0a9896c2e73ffdcf982b44b4683d155a

        SHA256

        59a9e08e83de790add2307d86381c88ee787506ad6f00112c43c1b62dab7303a

        SHA512

        953f51cf527320ae67c3c3217eab5197c396eba548c20233b5a3bcadf3290e13478d1c1ec46768bbdbd4231e3fdcf7fb72714cb58ad2e88be0debc8ece23ee27

      • F:\$RECYCLE.BIN\S-1-5-21-1497073144-2389943819-3385106915-1000\DDDDDDDDDDD

        Filesize

        129B

        MD5

        3a1b46d878509dcb546642b0063115bc

        SHA1

        4384bbe72c284989aeeae0cf276a7e3b571898e7

        SHA256

        e9fa5cfb7016b3aef17bfeb8ddda2c09598150ac8ca231da1d33d6956246284d

        SHA512

        f5122e35e543dcb35e7cb09023c417bc8bc2672d7ca116329fe956b3a908eb70efc3d5f58c50bf314c2ac6dfc954837380425700a843c72ecd63fde413c18e13

      • memory/3148-2820-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2815-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2849-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2827-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2826-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2825-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2824-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2807-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

        Filesize

        64KB

      • memory/3148-2808-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

        Filesize

        64KB

      • memory/3148-2809-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

        Filesize

        64KB

      • memory/3148-2810-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

        Filesize

        64KB

      • memory/3148-2811-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2812-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

        Filesize

        64KB

      • memory/3148-2813-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2814-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2823-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2816-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2818-0x00007FFFB3C80000-0x00007FFFB3C90000-memory.dmp

        Filesize

        64KB

      • memory/3148-2817-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2819-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3148-2821-0x00007FFFB3C80000-0x00007FFFB3C90000-memory.dmp

        Filesize

        64KB

      • memory/3148-2822-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

        Filesize

        2.0MB

      • memory/3392-2764-0x000000007FE40000-0x000000007FE41000-memory.dmp

        Filesize

        4KB

      • memory/3392-2806-0x000000007FE00000-0x000000007FE01000-memory.dmp

        Filesize

        4KB

      • memory/3392-2805-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

        Filesize

        4KB

      • memory/3392-2775-0x000000007FE20000-0x000000007FE21000-memory.dmp

        Filesize

        4KB

      • memory/3392-2774-0x00000000026D0000-0x00000000026E0000-memory.dmp

        Filesize

        64KB

      • memory/3392-2765-0x00000000026D0000-0x00000000026E0000-memory.dmp

        Filesize

        64KB

      • memory/3392-2804-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

        Filesize

        4KB

      • memory/4088-0-0x0000000003240000-0x0000000003250000-memory.dmp

        Filesize

        64KB

      • memory/4088-1-0x0000000003240000-0x0000000003250000-memory.dmp

        Filesize

        64KB