Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2024 20:27
Behavioral task
behavioral1
Sample
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe
-
Size
148KB
-
MD5
52d4594deedeb91119fe521913a00d63
-
SHA1
6fe557247936badebc8676248275cd2f00106655
-
SHA256
74090a22f4713933e21739eb08a99705407554ff204201829894ab38405644f6
-
SHA512
39c3e13a6982e3368fe4045b836b79398c3a0e9ce1239370e9d084ef9aed0041d9794c2bf2c511343f98fe041139f052a52f5b52437c3259267baf59d8837f69
-
SSDEEP
3072:7qJogYkcSNm9V7D105NoSUhIhI8YoXXjT:7q2kc4m9tD1Sy1oH
Malware Config
Extracted
C:\QO5k5RIUs.README.txt
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Renames multiple (577) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5488.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 5488.tmp -
Deletes itself 1 IoCs
Processes:
5488.tmppid process 1320 5488.tmp -
Executes dropped EXE 1 IoCs
Processes:
5488.tmppid process 1320 5488.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exedescription ioc process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-566096764-1992588923-1249862864-1000\desktop.ini 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-566096764-1992588923-1249862864-1000\desktop.ini 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\QO5k5RIUs.bmp" 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\QO5k5RIUs.bmp" 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
5488.tmppid process 1320 5488.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.QO5k5RIUs 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.QO5k5RIUs\ = "QO5k5RIUs" 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QO5k5RIUs\DefaultIcon 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QO5k5RIUs 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QO5k5RIUs\DefaultIcon\ = "C:\\ProgramData\\QO5k5RIUs.ico" 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exepid process 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
5488.tmppid process 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp 1320 5488.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeDebugPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: 36 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeImpersonatePrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeIncBasePriorityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeIncreaseQuotaPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: 33 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeManageVolumePrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeProfSingleProcessPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeRestorePrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSystemProfilePrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeTakeOwnershipPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeShutdownPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeDebugPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeBackupPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe Token: SeSecurityPrivilege 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe5488.tmpdescription pid process target process PID 2112 wrote to memory of 1320 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 5488.tmp PID 2112 wrote to memory of 1320 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 5488.tmp PID 2112 wrote to memory of 1320 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 5488.tmp PID 2112 wrote to memory of 1320 2112 2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe 5488.tmp PID 1320 wrote to memory of 4788 1320 5488.tmp cmd.exe PID 1320 wrote to memory of 4788 1320 5488.tmp cmd.exe PID 1320 wrote to memory of 4788 1320 5488.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_52d4594deedeb91119fe521913a00d63_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\ProgramData\5488.tmp"C:\ProgramData\5488.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\5488.tmp >> NUL3⤵PID:4788
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5b0ba0c215c2801a48a5fe72f03f522df
SHA1740ae90be98edcb6678a282f364d183577f49a4e
SHA256722659c5cd315a48d64f326d427515b285ff480e5400dcbb5a9c45c9907a6cee
SHA5120d47b6cb66ccc0b6b514dda66abd92d2f5bb0d2f43e5547b4071dfaaedde269f77800b5044b18fd37fa1957c840c1d6903c5368ef759ad47a3f06b48e3f0087a
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
2KB
MD5969eefd53ce46f724b4c45f426b28f70
SHA1cc626fa772b4b79af2cebe56cfb4cbef63d31544
SHA256c2431ae1310671c5c7e13d005e0b9c53f17bafa31fe2d75f6bd645f7deeb01b1
SHA51285f745c97e569e3b8afcb2547bb6b47b05345bb2d2bf8874c67e873f412a1be95ab46264db030856b959309efb9cc31dbca227eaa80cfa68d8e7a0d74aff72b8
-
Filesize
148KB
MD5d31ed902e8f83cb80f4f63b21767680f
SHA170c3e53964f179247e12564b1025b9d6f07f517b
SHA256713135b6817cb131443f0acd6fc961aad7345b53b8a28f4f0024f4b792151b57
SHA512f4acceadc692b959a4ead197b14bd72e5bae7afc663d48d07e7c9a47b4894cc1fd5c5c0de7f742cbdf3167c82b737f8dbb61fa2885bf08356df1e74e507ae448
-
Filesize
129B
MD5ef8198f13e7836e22c2a394984d95d8b
SHA12abf24245c0a3fbffff1aece224c3e701f6b7907
SHA2562a366cad9969f32877230598cf5d4a865722fca161cd6d540fed5a4d7fbd003f
SHA5121514f23728436c8fcaea875cdd667b9b88537a8e73308be0100a8b51e3dcdd92f5ac3beedea9ebf2de9a9989f7480e062cb0866f2cfe3f470ecec46e0dc6d786