Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 11:28
Behavioral task
behavioral1
Sample
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe
-
Size
194KB
-
MD5
ae811bd6440b425e6777f0ca001a9743
-
SHA1
70902540ead269971e149eaff568fb17d04156af
-
SHA256
86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498
-
SHA512
3617d8e77c221525125778cf64f2525136f7958766f5bed0fd7bfe00e7f738017d2840972acc628e4c3471b93cf6d52ccd619f49bdbbcff824c12cac8e1ea88e
-
SSDEEP
3072:a6glyuxE4GsUPnliByocWepiHkZmlkQIQP6fo:a6gDBGpvEByocWeQwLAPm
Malware Config
Signatures
-
Renames multiple (328) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
ACD3.tmppid process 596 ACD3.tmp -
Executes dropped EXE 1 IoCs
Processes:
ACD3.tmppid process 596 ACD3.tmp -
Loads dropped DLL 1 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exepid process 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\kZd6jLIwz.bmp" 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\kZd6jLIwz.bmp" 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exeACD3.tmppid process 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 596 ACD3.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kZd6jLIwz\DefaultIcon 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kZd6jLIwz 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\kZd6jLIwz\DefaultIcon\ = "C:\\ProgramData\\kZd6jLIwz.ico" 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kZd6jLIwz 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kZd6jLIwz\ = "kZd6jLIwz" 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exepid process 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
ACD3.tmppid process 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp 596 ACD3.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeDebugPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: 36 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeImpersonatePrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeIncBasePriorityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeIncreaseQuotaPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: 33 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeManageVolumePrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeProfSingleProcessPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeRestorePrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSystemProfilePrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeTakeOwnershipPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeShutdownPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeDebugPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeBackupPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe Token: SeSecurityPrivilege 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exeACD3.tmpdescription pid process target process PID 2184 wrote to memory of 596 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe ACD3.tmp PID 2184 wrote to memory of 596 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe ACD3.tmp PID 2184 wrote to memory of 596 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe ACD3.tmp PID 2184 wrote to memory of 596 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe ACD3.tmp PID 2184 wrote to memory of 596 2184 2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe ACD3.tmp PID 596 wrote to memory of 1968 596 ACD3.tmp cmd.exe PID 596 wrote to memory of 1968 596 ACD3.tmp cmd.exe PID 596 wrote to memory of 1968 596 ACD3.tmp cmd.exe PID 596 wrote to memory of 1968 596 ACD3.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_ae811bd6440b425e6777f0ca001a9743_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ACD3.tmp"C:\ProgramData\ACD3.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\ACD3.tmp >> NUL3⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\CCCCCCCCCCCFilesize
129B
MD508315a5ec9932c0bc6e9f894e4865e82
SHA113a313e672ef7b68ef0ba9832fd47765f51e6288
SHA256ded4806893fa6323538d0023ded538f81d68c714ed0329c89531ffbb38e9d2ea
SHA5127110aa1a4964dfc73189a10c9dbd3d088f2d7c42679939a99888ba63d8c2d70eee88decb1eb250fa94407a8f6b314740e39807aca1db60f0a189446712bbb9c9
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDFilesize
194KB
MD51f31b9be9b875bcdce3b113c2a1156b4
SHA18287acacf3eb18654b853897c7605b9f1ac84842
SHA2560c27aef9221c836d26ad10fbd0c2e86ff6be71e89c2db62f036be6a08f423bfe
SHA512a5db35a183c818d5f4e036e0ab5308c4ac1151da06302a8350cdc8666ef75276a4f3a32e65d7bbb65b3ecfd80b0a87fb4d463b7cd1cc12a8951caf59513de517
-
C:\kZd6jLIwz.README.txtFilesize
449B
MD5c2f46db865b0ba6ef8f9385cf458a56e
SHA10b2f94fcf38ef15f59bb86a3296b7da514b4ac4e
SHA256c25759e6083dd4bf592a6da2063c45def5adc9a6ef2ed15820128a0d838f70fe
SHA5129927b209ca26e3243fac9f003c6af7663ba84405346fbdb66c6f401387cd20ea3f99d63d0858ebdc76f2e6bc722d41e2a1f599bc6f7d97b0687dba95dea31b39
-
F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\BBBBBBBBBBBFilesize
129B
MD5819bd52f8b9dbfb2a066d6480ad385f9
SHA1b191dafd1226b5435920485dae155cce5ba698bc
SHA25686a71938c77bff2b62d24b982b017b7607d1e4f7437b923aba628a0bd97d5238
SHA51286f94546f816261f0144f493efcb709b7a9a71c466d39c5bba234992fa0373cc0d345d5ca5281eb439ce178c5c346e0f5bca5da34236ca4e58efd0f26c99e1ad
-
\ProgramData\ACD3.tmpFilesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
memory/596-846-0x000000007EFA0000-0x000000007EFA1000-memory.dmpFilesize
4KB
-
memory/596-847-0x00000000004E0000-0x0000000000520000-memory.dmpFilesize
256KB
-
memory/596-856-0x000000007EF20000-0x000000007EF21000-memory.dmpFilesize
4KB
-
memory/596-848-0x000000007EF80000-0x000000007EF81000-memory.dmpFilesize
4KB
-
memory/596-878-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/596-879-0x000000007EF60000-0x000000007EF61000-memory.dmpFilesize
4KB
-
memory/2184-0-0x0000000000D90000-0x0000000000DD0000-memory.dmpFilesize
256KB