Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 15:14

General

  • Target

    2024-03-13_b68bf58ebf923d66ba30f4c892ff59d5_darkside.exe

  • Size

    146KB

  • MD5

    b68bf58ebf923d66ba30f4c892ff59d5

  • SHA1

    3cb43567b90fd56edf0123cea2f46cc1b1290a83

  • SHA256

    c0afa7d1d390d4d6310be70c31a01fb668521fb33a2b3239e41f3e8231451eac

  • SHA512

    50eca65bde5718004694a33460ee5895b7fc9ce1679387399de739772982f93b07d28c939f314bc6edf22a7ee9f0391424dc92062af8c19eaf4349593ab45d50

  • SSDEEP

    3072:96glyuxE4GsUPnliByocWep/7pwO8OlP6:96gDBGpvEByocWehPTy

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-13_b68bf58ebf923d66ba30f4c892ff59d5_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-13_b68bf58ebf923d66ba30f4c892ff59d5_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:1992
    • C:\ProgramData\D0C.tmp
      "C:\ProgramData\D0C.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D0C.tmp >> NUL
        3⤵
          PID:2636
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3584
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{FBD4FDDC-1799-4080-AB23-2B495EC67C7C}.xps" 133548165133840000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:3804

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\AAAAAAAAAAA

        Filesize

        129B

        MD5

        ae7915ec1e469888401ffc1bd5a7ef9a

        SHA1

        729ffed25005716ae17441088f4eb2d7e7acc73a

        SHA256

        62390ea6672eb242fcc7391dbeee43e2ba0c3e2d2bb377e4e8ec17cea63947e3

        SHA512

        50921d57021e9f6f111c8dd3dccd8ece5e91c710840b0abc0207e801cbace9a7b4a3bba51c988154ba12d2cd778c7bc0159581fa6d39f41b4a2c324b6bdcacbf

      • C:\PD9tZdd3p.README.txt

        Filesize

        732B

        MD5

        3c30a01742ea1df843789b45788be189

        SHA1

        fccfb826237ba1d9bf28c938837b76522b864532

        SHA256

        d3ac4e88de00362317d3aff94930598ef32d3da8d67eebbf03f01d19fd297876

        SHA512

        b0bc1a90f83813d4b9c8ee01b5c718381bfef2675140602753a24c033fa3b352e68a556988d4bc3d718d08a1564245bd634f26e96095e94c1605a9213d570a2f

      • C:\ProgramData\D0C.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

        Filesize

        146KB

        MD5

        ab37d27f5a2fdf24ccaf91ade1f96b6a

        SHA1

        2029cdb52d7216ea5c79d4974a2630a6d98f38f1

        SHA256

        8fe62239224687d2728e00fd047237c76fac41cdc37fbad67227ed08f3e295e5

        SHA512

        0e3a37f0d449874b00f6bc9bcd6c137d939e8230da32fa601fcedb3253d4240aaf72353947f1821cea60b052b3eade2302fd0eea16161e88c0783bef62996005

      • C:\Users\Admin\AppData\Local\Temp\{3F288CA6-547D-4647-B03E-704A8AC8D19A}

        Filesize

        4KB

        MD5

        1b9535c7df4f92e3c836a234a89a5614

        SHA1

        a86ca7ede9eaa11e2ae0452f1257a6f7298febe8

        SHA256

        d19c9a109966b4aee274e7c2f0253fd146d83b31db16f780c00451b86e21db7b

        SHA512

        0ca63ccb9e71787f0aaca1e4205d87903bfe61465ecaa7e78d0c066cdec2c9e2d5f5dd4c98456a483b06607106d7da5b2c1d832b6681f19cb3c12054155c73a8

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

        Filesize

        4KB

        MD5

        6889a9288f74e3aeaa9cbdd9914b4b73

        SHA1

        633fe07dc8479df849dabc1698e11e7442b9c68e

        SHA256

        d8a1bcda46149cf1db09d2db349dae09da9939c8f06541249a0f5fa5b903f3c5

        SHA512

        6612fa7d0a1af82aa52c52e5284da8674de3aee577f5b78b7c3d5045c4f63b2aef42b14a08edb37fb4d43c0de847d9d15fecf9db5997985769193bb7035c5df9

      • F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\EEEEEEEEEEE

        Filesize

        129B

        MD5

        5bf01a57f80a8b802ff42b7cef1baaba

        SHA1

        49e7d2cc79e18feb9e06ee0adb7d676b5896307b

        SHA256

        7dff78ae76c4966cbb596f89b1b177beed733c42d2ade8ca9591bd59d3bf490f

        SHA512

        9e95744f0e01269e0b9ff1888749a44f1bacf0e4107d6f56223056dba65e9cfcaf23874d0df18ff5d16cc0f226d0db86f3bee9d2026efe5a17629505dd0650a5

      • memory/1428-2788-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

        Filesize

        4KB

      • memory/1428-2787-0x000000007FE20000-0x000000007FE21000-memory.dmp

        Filesize

        4KB

      • memory/1428-2785-0x0000000002630000-0x0000000002640000-memory.dmp

        Filesize

        64KB

      • memory/1428-2755-0x0000000002630000-0x0000000002640000-memory.dmp

        Filesize

        64KB

      • memory/1428-2753-0x000000007FE40000-0x000000007FE41000-memory.dmp

        Filesize

        4KB

      • memory/3804-2791-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2796-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2754-0x00007FFF1AD10000-0x00007FFF1AD20000-memory.dmp

        Filesize

        64KB

      • memory/3804-2752-0x00007FFF1AD10000-0x00007FFF1AD20000-memory.dmp

        Filesize

        64KB

      • memory/3804-2831-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2786-0x00007FFF1AD10000-0x00007FFF1AD20000-memory.dmp

        Filesize

        64KB

      • memory/3804-2830-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2809-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2790-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2789-0x00007FFF1AD10000-0x00007FFF1AD20000-memory.dmp

        Filesize

        64KB

      • memory/3804-2807-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2792-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2793-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2795-0x00007FFF18910000-0x00007FFF18920000-memory.dmp

        Filesize

        64KB

      • memory/3804-2794-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2761-0x00007FFF1AD10000-0x00007FFF1AD20000-memory.dmp

        Filesize

        64KB

      • memory/3804-2797-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2798-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2799-0x00007FFF18910000-0x00007FFF18920000-memory.dmp

        Filesize

        64KB

      • memory/3804-2800-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2801-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2802-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2803-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2804-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2806-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/3804-2805-0x00007FFF5AC90000-0x00007FFF5AE85000-memory.dmp

        Filesize

        2.0MB

      • memory/4924-0-0x0000000002960000-0x0000000002970000-memory.dmp

        Filesize

        64KB

      • memory/4924-2735-0x0000000002960000-0x0000000002970000-memory.dmp

        Filesize

        64KB

      • memory/4924-2-0x0000000002960000-0x0000000002970000-memory.dmp

        Filesize

        64KB

      • memory/4924-1-0x0000000002960000-0x0000000002970000-memory.dmp

        Filesize

        64KB

      • memory/4924-2736-0x0000000002960000-0x0000000002970000-memory.dmp

        Filesize

        64KB

      • memory/4924-2737-0x0000000002960000-0x0000000002970000-memory.dmp

        Filesize

        64KB