Analysis
-
max time kernel
118s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-03-2024 22:33
Behavioral task
behavioral1
Sample
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe
-
Size
153KB
-
MD5
be4bc91ee9da747823a17fcd60f8e5b0
-
SHA1
0a508de21e761062cc51098487b1922bc303d05c
-
SHA256
bb7acad97b896bb0d93ee982046b2f9dba1fcb391130c18ec0f4a7e1d792c50f
-
SHA512
753db224a72a6f69f75fffe485ed9a7f8cf0ebbf0d86cb487cfb2fe8cd6d31e6edd86a3561ac502b58c14037c4eefa4f7552a6d0d4e7aece4b0fdbb93c0b653b
-
SSDEEP
3072:rqJogYkcSNm9V7DDOQnN7b9Xyfs0BBAT:rq2kc4m9tDBnFb9i
Malware Config
Extracted
C:\ybRiTB9wP.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
AE87.tmppid process 2824 AE87.tmp -
Executes dropped EXE 1 IoCs
Processes:
AE87.tmppid process 2824 AE87.tmp -
Loads dropped DLL 1 IoCs
Processes:
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exepid process 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ybRiTB9wP.bmp" 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ybRiTB9wP.bmp" 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
AE87.tmppid process 2824 AE87.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\Desktop 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ybRiTB9wP 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ybRiTB9wP\ = "ybRiTB9wP" 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP\DefaultIcon 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP\DefaultIcon\ = "C:\\ProgramData\\ybRiTB9wP.ico" 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exepid process 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
AE87.tmppid process 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp 2824 AE87.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeDebugPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: 36 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeImpersonatePrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeIncBasePriorityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeIncreaseQuotaPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: 33 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeManageVolumePrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeProfSingleProcessPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeRestorePrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSystemProfilePrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeTakeOwnershipPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeShutdownPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeDebugPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeBackupPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe Token: SeSecurityPrivilege 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exeAE87.tmpdescription pid process target process PID 1920 wrote to memory of 2824 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe AE87.tmp PID 1920 wrote to memory of 2824 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe AE87.tmp PID 1920 wrote to memory of 2824 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe AE87.tmp PID 1920 wrote to memory of 2824 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe AE87.tmp PID 1920 wrote to memory of 2824 1920 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe AE87.tmp PID 2824 wrote to memory of 1472 2824 AE87.tmp cmd.exe PID 2824 wrote to memory of 1472 2824 AE87.tmp cmd.exe PID 2824 wrote to memory of 1472 2824 AE87.tmp cmd.exe PID 2824 wrote to memory of 1472 2824 AE87.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\ProgramData\AE87.tmp"C:\ProgramData\AE87.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AE87.tmp >> NUL3⤵PID:1472
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:1924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD597125f6de87f7035cce6a571312fc665
SHA1797ef5cca3ce592a7cbd27048010e9d72ccfced4
SHA256077c7080d4c29731aaf8174890c07b820d86ea7ad5dfcbbc2a9f92c9c85431bc
SHA51238ae49d5c33d631bf27a8715908d4301722d1c1760eb96cd36dcca917cedc6d7a5683d4e355cc3e5ae0218172c7fe399f2180c0289d92c96a3715769579b9b40
-
Filesize
153KB
MD5044ce2f29878af6d304eb6ad9b729ff2
SHA1134569d9f3584557989acd85669a3d9a10ac0b12
SHA25698ba626c81876ab3c7885295cbf087c889e9464139290dc7f68ba38580a80b4a
SHA51275c214b0348958f5c51b24abd29209feec8974f8404b066b0fb5d6590341005aa4805e35f28fbe55a7ae1706da89e4633d3a4cae519f4f9b64ee6edeaa5cb749
-
Filesize
6KB
MD53d76fce32c70b69cfe7741ef8e77e6b0
SHA150be438224cd1a3b63a654d24a0f30023495e53e
SHA256121a34dc218f6f1004fa3932713957b8c4fcdec8ec3d699cb3700578e845fa5c
SHA5120c7c67795ebd9986076c7766c34c1cee48aff642ffd5ae05edab9f2b08997452092951739d0e5054a3a804abb65256ebb79a524f0182bdd61754ba6b4b26b1fb
-
Filesize
129B
MD51f15658592b6fba1c6a0b25467d2e92e
SHA1ba99c210e4707ce77791f88ff1dde1823313adc5
SHA2567a0c7d04039164473a3c52122012d7eef9f378deebf779f2ccf30ca4953718cc
SHA512b8cdbf0bb400fd51677f7d940f19909c588c6e1a468e100686a1e134513e7c0c500aba28022dcc089f55b754ac032330e2629e816572610021f47cf7663ca33d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf