Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-03-2024 07:41
Behavioral task
behavioral1
Sample
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe
-
Size
153KB
-
MD5
22a0002d0c856af8ce443c65fcfb3e66
-
SHA1
01a123f73656a856a80ddb5962d7926b6641c8fd
-
SHA256
0b52d5d29e42804706f99a724ec94d0e2f0fd2a4dfcfbe4ff4e0403e00a71e49
-
SHA512
676e86afb4d39356a7e1631be2c32a3b3c24fc2f498b231399a565ec534a830b4ed838a3f8f51c484fe8cea32b0790c70a91b4e6ff74a588535b85918868aee0
-
SSDEEP
1536:UzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtyUQX3S0bcSZ9pgTmyW1fsoxrH:7qJogYkcSNm9V7Dtyv3lubW1UId9T
Malware Config
Extracted
C:\nbLGVxVJx.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
11A.tmppid process 1088 11A.tmp -
Executes dropped EXE 1 IoCs
Processes:
11A.tmppid process 1088 11A.tmp -
Loads dropped DLL 1 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exepid process 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\nbLGVxVJx.bmp" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\nbLGVxVJx.bmp" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
11A.tmppid process 1088 11A.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nbLGVxVJx 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nbLGVxVJx\ = "nbLGVxVJx" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx\DefaultIcon 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx\DefaultIcon\ = "C:\\ProgramData\\nbLGVxVJx.ico" 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exepid process 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
11A.tmppid process 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp 1088 11A.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeDebugPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: 36 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeImpersonatePrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeIncBasePriorityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeIncreaseQuotaPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: 33 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeManageVolumePrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeProfSingleProcessPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeRestorePrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSystemProfilePrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeTakeOwnershipPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeShutdownPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeDebugPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeBackupPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe Token: SeSecurityPrivilege 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe11A.tmpdescription pid process target process PID 2756 wrote to memory of 1088 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 11A.tmp PID 2756 wrote to memory of 1088 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 11A.tmp PID 2756 wrote to memory of 1088 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 11A.tmp PID 2756 wrote to memory of 1088 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 11A.tmp PID 2756 wrote to memory of 1088 2756 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe 11A.tmp PID 1088 wrote to memory of 3036 1088 11A.tmp cmd.exe PID 1088 wrote to memory of 3036 1088 11A.tmp cmd.exe PID 1088 wrote to memory of 3036 1088 11A.tmp cmd.exe PID 1088 wrote to memory of 3036 1088 11A.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\ProgramData\11A.tmp"C:\ProgramData\11A.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\11A.tmp >> NUL3⤵PID:3036
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1501⤵PID:3000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a2014f4f8bb173261c8000ee8a4de558
SHA1d171d55f4651726fda59f17e9c4f15a0330a1548
SHA256fb5f6576330fb494817fe7ed4eba7b3896137462ef5d189b117b0f5a1ed03472
SHA51269257e7bbf8009f5cbb4c87f657f0d40301407cd98a447da21161313e918f83535904074102c87f111b28371ba41e2247839400ecdb3db89fb912650c8c0ef48
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD5cb1aa085fb3c23e5ebf170df62f5a3fa
SHA1b786f7e1fdd4e28c438486a969d334bd3a180203
SHA256ef6a23b766c56ab9531172895517b9811d72c843d54fab77da74be9cd8f0bcaa
SHA5124b0c3f3cfe3773711f3beb25bd1b18c3491089d04e6a4b1622ad9cae0ab45d6696c1be011b5b6dbbb32896297df45eab44377593319e4f75c862373b5c701c37
-
Filesize
6KB
MD58ec36b04934bbf8793887ff9024cecce
SHA147545f1bf4441ec36ac2990adf932d6e5664621c
SHA256bdbb345693446842c655208ab5382a89e1a0b3b5ca5e609b4680d4924ee6545e
SHA5123c2e19de0844cee030040e523458b6694e6442ad52fab2c1176cabf35361bea99eabcaf9c72cf2ce543f34e62463ab28d67b7e5079129fdb65c9d032191ad93c
-
Filesize
129B
MD5d202da2b8c64ef7e73126c636b14cef3
SHA15645493db504fec43911031843e0ed9bde9ba63f
SHA25636424f02dd5f363691269096a3727a7d01fc81ec6239a92a85259c970cf5b5db
SHA512d8e0605f0250ce5a9a23dfdaca11776e2806eb994dfe880d59ca8fc77e589fcfb076299e6e61af682ef01d023e2c2e102b567f3c5c33c52d890320abac0c5eae