Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-03-2024 20:27

General

  • Target

    2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe

  • Size

    148KB

  • MD5

    52d4594deedeb91119fe521913a00d63

  • SHA1

    6fe557247936badebc8676248275cd2f00106655

  • SHA256

    74090a22f4713933e21739eb08a99705407554ff204201829894ab38405644f6

  • SHA512

    39c3e13a6982e3368fe4045b836b79398c3a0e9ce1239370e9d084ef9aed0041d9794c2bf2c511343f98fe041139f052a52f5b52437c3259267baf59d8837f69

  • SSDEEP

    3072:7qJogYkcSNm9V7D105NoSUhIhI8YoXXjT:7q2kc4m9tD1Sy1oH

Malware Config

Extracted

Path

C:\QO5k5RIUs.README.txt

Ransom Note
~~~ LockBit 3.0, the fastest ransomware in the world since 2019 ~~~ >>>> What happened? Your data is stolen and encrypted, the data will be published on TOR website if you do not pay the ransom. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we don't need anything other than your money. If you pay, we will provide you with the decryption programs and delete your data. Life is too short to be sad. Don't be sad, money is just paper. If we don't provide you with decryptors or delete your data after payment, no one will pay us in the future. This is why our reputation is very important to us. We attack businesses worldwide and there are no unsatisfied victims after payment. You can get information about us on Twitter: https://twitter.com/hashtag/lockbit?f=live >>>> How to pay to get the decryptor? You must contact us by email to be able to send us a message with the payment screenshot with your personal decryption id, so we will contact you again to give you our recovery software. Your personal decryption id: 8B87E170009F892031583A62EB771EA7 Our Bitcoin payment address: bc1q43rlc0qscd4xh2p5xxk2hnqtd4qrg4c9sn3f84 The amount to pay: 200.00$ Our contact email address: [email protected] >>>> Why Bitcoin? As for the issue of anonymity, bitcoin is often considered more anonymous than traditional payment methods because it is not directly linked to your identity. Bitcoin transactions are recorded on a public blockchain, but they are pseudonymous. >>>> How to buy bitcoin? To buy bitcoin, start by looking for trusted exchanges like Coinbase, Binance, or Kraken. Once registered on one of these platforms, explore options for purchasing bitcoin using your local currency. Familiarize yourself with the process of verifying and securing a digital wallet. >>>> Information? Attention ! Do not delete or modify any files, this may cause recovery problems! Attention ! If you don't pay the ransom, we will repeatedly attack your business again!
URLs

https://twitter.com/hashtag/lockbit?f=live

Signatures

  • Renames multiple (309) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\ProgramData\ADBD.tmp
      "C:\ProgramData\ADBD.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\ADBD.tmp >> NUL
        3⤵
          PID:3028
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x154
      1⤵
        PID:1944

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\AAAAAAAAAAA

        Filesize

        129B

        MD5

        25a5336cc15fb97f653b21b3c06f9aee

        SHA1

        1183160f8ebb78a3ea8ece37613918eaf9eadc41

        SHA256

        a7312a3547ec6597d45b778b6b28395d65df20b203d4330aad77bc82eb65d0d8

        SHA512

        ddb7e18ec49ebaf30aea5f434018975826b6d9b857f14d97c49bbcb52228f684a550f007c71c79786414941f8038915e161bcdee1da61e4a3e7f4ac063d667ec

      • C:\QO5k5RIUs.README.txt

        Filesize

        2KB

        MD5

        d88d24ad3ac8d220a30a8b462a7622c0

        SHA1

        5729a91443332a63606ab87fc02f3768da0a7cd9

        SHA256

        572c02968998b39d6d3be98b7f3d27aae304173e9dea67748b2ae105147411e9

        SHA512

        913fa11d10c3bebc8989907415a5fd151574e44a7ca7cef610f1a6b60eab4206724cd528fb40f8d708b62c6edf16cc000fd7cb7259ffe66bd2151765d493e218

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

        Filesize

        148KB

        MD5

        e472d5865affc408e408cc601d137e4f

        SHA1

        870ed83820852edde375e97beb0873da32b4faae

        SHA256

        f1fe56b9867f25f21aa5f126ad8cd4c130b567c2bb89bb969683124eb11cde16

        SHA512

        96ef45c708567f1f23ed95f22c5ba436cae7a932f539e30135e54d00562fa55bf3d08050eaf1f21e4876e6bfde64cea530f5a1601d71d6a26145df1add1e51a2

      • F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\DDDDDDDDDDD

        Filesize

        129B

        MD5

        2e281498c382d65364715144241c9e71

        SHA1

        a97b9690786ba65f3dc527f6b6d73cf2cf444a3c

        SHA256

        b271bed9e5c6694150b88720afa85f401932249dbd17e6aebfd7a285960bba03

        SHA512

        1250dc3a6d82cf869127119574eaf96fe870c85d352ab2a95a167dd9872adced721a96270df2fc1e5e957e7e0a7944eef858d4f4b150e90ebc98b3fc9f21ca99

      • \ProgramData\ADBD.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • memory/1280-0-0x0000000002570000-0x00000000025B0000-memory.dmp

        Filesize

        256KB

      • memory/1948-827-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

      • memory/1948-835-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

      • memory/1948-834-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

      • memory/1948-833-0x0000000001FE0000-0x0000000002020000-memory.dmp

        Filesize

        256KB

      • memory/1948-828-0x0000000001FE0000-0x0000000002020000-memory.dmp

        Filesize

        256KB

      • memory/1948-860-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

      • memory/1948-861-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB