Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 21:32
Behavioral task
behavioral1
Sample
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe
-
Size
156KB
-
MD5
75e3d908fdddee413481dba88258783b
-
SHA1
4cd6c1a88f3575d298aa168356651d5237bb72ab
-
SHA256
36aae3ba1a6fd78e040bba4522f6c15d5a3627ae78b27ff6879ee64d038445a4
-
SHA512
d7c1e0bd3eb3888579ef696ea48ae4d83d70f08b3bafb23288a81ed40e1501513e2739af119c4a0f9d788f7aa4a6500df80260151a8eeeb7f6fe19fc5cf34256
-
SSDEEP
3072:ZfDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP33686plZG1kqxSb6W:ZB5d/zugZqll32rZ2txSb
Malware Config
Extracted
C:\Users\O957g99QW.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Signatures
-
Renames multiple (151) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
9EBF.tmppid process 2572 9EBF.tmp -
Executes dropped EXE 1 IoCs
Processes:
9EBF.tmppid process 2572 9EBF.tmp -
Loads dropped DLL 1 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exepid process 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\O957g99QW.bmp" 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\O957g99QW.bmp" 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe9EBF.tmppid process 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp -
Modifies Control Panel 2 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon\ = "C:\\ProgramData\\O957g99QW.ico" 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW\ = "O957g99QW" 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exepid process 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
9EBF.tmppid process 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp 2572 9EBF.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exevssvc.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeDebugPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: 36 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeImpersonatePrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeIncBasePriorityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeIncreaseQuotaPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: 33 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeManageVolumePrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeProfSingleProcessPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeRestorePrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSystemProfilePrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeTakeOwnershipPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeShutdownPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeDebugPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2780 vssvc.exe Token: SeRestorePrivilege 2780 vssvc.exe Token: SeAuditPrivilege 2780 vssvc.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeSecurityPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe Token: SeBackupPrivilege 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exedescription pid process target process PID 2240 wrote to memory of 2572 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 9EBF.tmp PID 2240 wrote to memory of 2572 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 9EBF.tmp PID 2240 wrote to memory of 2572 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 9EBF.tmp PID 2240 wrote to memory of 2572 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 9EBF.tmp PID 2240 wrote to memory of 2572 2240 2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe 9EBF.tmp -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_75e3d908fdddee413481dba88258783b_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\ProgramData\9EBF.tmp"C:\ProgramData\9EBF.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
PID:2572
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD59c04e553575018ae615dddd15f1bbe8a
SHA19def192f4fa5f90e86d71187edc7815fbadafd20
SHA256b6bd31ebfc75e1dd462473ceaeef656a96091221dd329490a01bf5e5c334b269
SHA5127ae4bab7220be7a5cf801208aa255973b033a836f52287ca4684394ec885ea7302532d8e72aff661030357ffb8d11593983c9a9028004daeafcc1cf98c105056
-
Filesize
156KB
MD57344144987c0656a8f498f807a9e3183
SHA1daa26387cb547c9dc3a2e5e3c44130ce3ec42d57
SHA25621bbffcc29e11c2f1d71911436ab02480a370922f7bf4cb655bb8be03277dae6
SHA512ba48df7a84847b9a62751e5c1a9c3d4e8cd0191d17aa0c940bb614769394d788ded93e68b8e3daef78e8b821ea9e6745c5b792da62078cfc83e9ef31a839f204
-
Filesize
3KB
MD5b88940fa8bf0e2daabc9f245797260de
SHA142f08e7f1e7fab894c6e0be39f0f2da80614a41e
SHA25634e4e1ec8181985e204eae174c8dffb710de4bdc2e66f1dc38008702a573fdfa
SHA51270268fd05b6b226c359159ecde017928a33573f344723a2f1aa259e10becac284968a1e00ccb8944cccc53f10e872a385d887bc2b64506d2defa58ef301c2257
-
Filesize
129B
MD5de0d52ff91f8a6f734a1a683ac79685d
SHA1dcac846caa9edf0814095c32bee6d762443209aa
SHA256c2f45a45951d0273411c7ed8b29199ac99ecc9d52d3c326cb5e6bb2e06285e3c
SHA512666f18f2fa665604f468a55c42eb89051c1281f750e88e37adc2b5fd5317a2fdfb2ee1018529fbfcd1da1f7faa882e5ee97ecda396fe0e43c29e98dcfbef4d7e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf