Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 22:32

General

  • Target

    2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe

  • Size

    149KB

  • MD5

    ac6a7885e55155b6025f45bf90d5af64

  • SHA1

    08d5edf13c34b78c68c6a01e1f2346baa9de5d54

  • SHA256

    a779818597f3d64aac07f3db86bfa6019bf84069691e581f9f2d1b5a0c15daf0

  • SHA512

    1d13fb7f5808392883e9644b91d4423765f3ac063ade2d511c85302fb9c9ebe5d2819f908b2223bf20f49b3162879bef60f50980d70b7fc4f90d8c1b5be47e51

  • SSDEEP

    3072:S6glyuxE4GsUPnliByocWepBoOoWPuqMLWlYcaS:S6gDBGpvEByocWejotfqMClY0

Malware Config

Extracted

Path

C:\LPJKYjRBM.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in mail or tox. Tox ID LockBitSupp: 0DF6BDFBF6459753325943FAE72DF57F396F226FE7B9C1645D98750AAB01DF3CAFF6C13CBD52 mail Support: [email protected] >>>> Your personal DECRYPTION ID: 419A343AEF3FCBF817DA6ED1700B6E88 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in mail or tox. Tox ID LockBitSupp: 0DF6BDFBF6459753325943FAE72DF57F396F226FE7B9C1645D98750AAB01DF3CAFF6C13CBD52 mail Support: [email protected]
URLs

https://twitter.com/hashtag/lockbit?f=live

https://tox.chat/download.html

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Renames multiple (583) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac6a7885e55155b6025f45bf90d5af64_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:2948
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:3272
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{290AD492-DB90-4FA3-9582-EC21237DAD10}.xps" 133548427918130000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:1048

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\GGGGGGGGGGG

      Filesize

      129B

      MD5

      33408ff3550ad710a974b8c35a9c04c8

      SHA1

      33604eb69a40f012c36f6c8606864dd7ff1db9f8

      SHA256

      79bd02183197d044351acee855cdb2f37d8d1c8a6e6593c3b571f68dd88f5c78

      SHA512

      e16e29fadfc387c19a8c52bb3950ca1edaad93c745abe1178cf648e03d68ad2380acef404380f0a6b54b4557639597ea7e23fcfdfc4dfd2ddb99ce24b24dc3ac

    • C:\LPJKYjRBM.README.txt

      Filesize

      2KB

      MD5

      49d7a5d1df53ecdd8a0833b0534e994b

      SHA1

      109f6d182d4fa2088abc77ce6829096dd6e3d5b2

      SHA256

      377bb9d6e9786b2ea9f2f974fb152ff65d372a452667d0c958fe2f440cbf9250

      SHA512

      cca2532c96d56fa82dc54daa903e657da779a706a966bdbc68ea8da60f3bb8b1599d96aa9da7fbd0b35342d2f2cb24688ce66cd31f89b459d38b23c48481101a

    • C:\Users\Admin\AppData\Local\Temp\{A109750F-5E2E-42C5-912B-0C2AD7A76B13}

      Filesize

      4KB

      MD5

      7e93612b4d1adfbd1fa90ae2625d449b

      SHA1

      4f19e0d8cc970551739cdaef10f25e00117e0d92

      SHA256

      e398e8ff25c5b42f58dc56c2c3d93f4aea1b112740047861d2963735a06202c3

      SHA512

      0a1f82631c9d1c21a1a2d9ad6d7f95989ab424efdbeba6d1a8d8d57fb75bb4c467a97b37153ac6885e8d5430e93113e443236a91d15b335fddaeb078a62b2556

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

      Filesize

      4KB

      MD5

      a6fbd0f128db88ecc5c097f8c4180476

      SHA1

      d552e892f0c601df674b1a34152a1d3d1555418d

      SHA256

      992a1c17e128f72b332d8b41828c80a5c67f9e371ce036d3e4e266c2c4414869

      SHA512

      1a4dbd976a3998a37b26d3364c899ac2fe6fb387d90ac7b2fe04a8a63a4cc59107791d7aced8411879af3666f59bb6f65d37eaec0a9f7952d00f8038c178f897

    • F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\DDDDDDDDDDD

      Filesize

      129B

      MD5

      8c0354f8db4dd3e2574c60e319bb5d75

      SHA1

      04781be452bdf7ea2529fb0b42c15acbcaa7de5e

      SHA256

      13fce3dfc580cb743f530ab32b02ef94edaa30eec74a6b5356e6e954f0882d8e

      SHA512

      f402294858d7e36f49a752ec55fd96fb1e981f091a6afebb9e87a9dbeda206a01ed716b04dc285f5748fec178dcbf53182cd8ca2aa8aaaaa8bf164381d1ce166

    • memory/1048-2762-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2766-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2754-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2753-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

      Filesize

      64KB

    • memory/1048-2755-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2756-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

      Filesize

      64KB

    • memory/1048-2757-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2758-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

      Filesize

      64KB

    • memory/1048-2760-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

      Filesize

      64KB

    • memory/1048-2761-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2759-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2798-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2764-0x00007FF88AF10000-0x00007FF88AF20000-memory.dmp

      Filesize

      64KB

    • memory/1048-2765-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2763-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2752-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

      Filesize

      64KB

    • memory/1048-2769-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2768-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2767-0x00007FF88AF10000-0x00007FF88AF20000-memory.dmp

      Filesize

      64KB

    • memory/1048-2770-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2771-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2773-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2772-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2774-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2775-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1048-2797-0x00007FF8CCEF0000-0x00007FF8CD0E5000-memory.dmp

      Filesize

      2.0MB

    • memory/1108-1-0x0000000001250000-0x0000000001260000-memory.dmp

      Filesize

      64KB

    • memory/1108-2-0x0000000001250000-0x0000000001260000-memory.dmp

      Filesize

      64KB

    • memory/1108-0-0x0000000001250000-0x0000000001260000-memory.dmp

      Filesize

      64KB