Overview

overview

10

Static

static

10

2024-04-17...de.exe

windows7-x64

9

2024-04-17...de.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-17_ff4cd364323fc2048c35783a38070aef_darkside

  • Size

    147KB

  • Sample

    240417-tas7yaef23

  • MD5

    ff4cd364323fc2048c35783a38070aef

  • SHA1

    4736172dd07a3a196343b94dd56b4e4edc0f2bce

  • SHA256

    6dd7522accb6773bade16720b53ca577574defae5b1c7caf4b7fc6826dfed7e7

  • SHA512

    c72b07b78ccbcfad14fa9f7bc3e8a086c29969b4f7f30dbe57a1a173cd82d61a20bf5ead0bc7b627d5d7f7f0def71710e2ce09590be7a886ad6c9414981eb961

  • SSDEEP

    1536:FzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEtDyI4njdbJBGCkmsQwvB6jr4j:GqJogYkcSNm9V7Dk4F91qYUrnbT

Score
10/10
lockbitransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-04-17_ff4cd364323fc2048c35783a38070aef_darkside

    • Size

      147KB

    • MD5

      ff4cd364323fc2048c35783a38070aef

    • SHA1

      4736172dd07a3a196343b94dd56b4e4edc0f2bce

    • SHA256

      6dd7522accb6773bade16720b53ca577574defae5b1c7caf4b7fc6826dfed7e7

    • SHA512

      c72b07b78ccbcfad14fa9f7bc3e8a086c29969b4f7f30dbe57a1a173cd82d61a20bf5ead0bc7b627d5d7f7f0def71710e2ce09590be7a886ad6c9414981eb961

    • SSDEEP

      1536:FzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEtDyI4njdbJBGCkmsQwvB6jr4j:GqJogYkcSNm9V7Dk4F91qYUrnbT

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (314) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks