Overview

overview

10

Static

static

3

ea3c8766df...08.exe

windows7-x64

10

ea3c8766df...08.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 04:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe

  • Size

    256KB

  • MD5

    d6b0b65300c7f9c0b700ab21f58990cc

  • SHA1

    1148829c7032b7c5907337b20902c70a584710a9

  • SHA256

    ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108

  • SHA512

    e7671432d936a800588859b6c878efba1a0e60b42abc5b0286420dd39cc612f67a2779c1f4d5870060b69446778c6207f6ef840125c73decfa765b910d5e8590

  • SSDEEP

    6144:BG2/9A5wlFbBkPj8uYDJTVmxAznfcFf0UoEF:k2VA5wlFbBkPj8uqJqkfcFfHoE

Score
10/10
darksideransomware

Malware Config

Extracted

Path

C:\Recovery\README.977f5beb.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/86GND2UGQRIP7OXI4KAHWDF3QR4ZDTJ3GGZA02KJYG7H6UDZ2U0DVB03WIUKOK73 When you open our website, put the following data in the input form: Key: RODfvJYqjv0mpxmuTDFwY5lLfDa0AKH3CO9ajV9EjZT2hxfwNztVLmaaEVQ305NtwqN3ThKuAhyiT1lUEPLbOGQYz17oTD1wqPWcYoKXTpFWIAQ23TuI7t2x4wj1Qxjy8SoCgyw2gBn8xwRGonZO6v9eKfe2j3xB4VmaFtpll2ZeKF0BReaSNSNlY7zkKNwxM65kYN4nBvFDT0ZoHYXHtl79bDt471lwrYw4vQJvsPgCa2LPCbinHj0cOLJyko3V3HWd5dOpuO28MAwxRnjcULRYkvobx1HShC6hxETzVOGIWma9XTEi0lzhtlAyp6TVYDydBeHjokOKWIesezWMug65kP2HQBzG66BsOQLjfQiMg8UmA8OsnuU1fcj6PljgdqvIF63ENiRBBW8NdUTOnqQQHhf4cRLb2gLAW7IrBx4bWrNyiPE9vNsOeWZ5Yf3MIXwTPs9hXRDMdGo9hbuD9gcniyIHHpxcrM4XNoxetF8JDB4vyC7dZizspkX1f2BwkpVxFSKv8tOgcpFwtR5yMiRYjrU51LEIAU8UK9olpKDl3WSeCpw8QqN !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/86GND2UGQRIP7OXI4KAHWDF3QR4ZDTJ3GGZA02KJYG7H6UDZ2U0DVB03WIUKOK73

Signatures

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside
  • Renames multiple (171) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe
    "C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"
    1⤵
      PID:4084
    • C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe
      "C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe
        "C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe"
        2⤵
        • Drops file in System32 directory
        • Sets desktop wallpaper using registry
        • Modifies Control Panel
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe
          C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe -work worker0 job0-3616
          3⤵
          • Drops file in System32 directory
          PID:1156
        • C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe
          C:\Users\Admin\AppData\Local\Temp\ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108.exe -work worker1 job1-3616
          3⤵
          • Enumerates connected drives
          • Drops file in System32 directory
          PID:892
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\README.977f5beb.TXT
      Filesize

      1KB

      MD5

      046211676cf955ca2e617c5c7128f54a

      SHA1

      24b6307e85d33dd271471d397ea3f7169f600f7f

      SHA256

      273c68d24bf1b305163237649cd0aff54679114a9fe43fad0c771a58e33e35db

      SHA512

      e26659a23d25ca7d98e9aeb7f08671bfcc64fc41a03c4be40332a1a4f2e49f66499a4c3f96ec08024b7efdf7e45a2efaeb8a05d9eff59b0557b90870c8cb9fe9

      Download Submit
    • memory/892-52-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/892-66-0x0000000000570000-0x0000000000571000-memory.dmp
      Filesize

      4KB

      Download
    • memory/892-93-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/892-35-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1156-26-0x00000000006C0000-0x00000000006C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1156-286-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1156-27-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1156-25-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1608-8-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1608-22-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1608-10-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1608-9-0x00000000004B0000-0x00000000004B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1608-12-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1608-11-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/3616-15-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/3616-23-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/3616-19-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/3616-18-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/3616-17-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/3616-20-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/3616-16-0x0000000000540000-0x0000000000541000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3616-288-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/4084-14-0x00000000006F0000-0x000000000072B000-memory.dmp
      Filesize

      236KB

      Download
    • memory/4084-1-0x00000000005B0000-0x00000000005B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4084-2-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/4084-3-0x00000000006F0000-0x000000000072B000-memory.dmp
      Filesize

      236KB

      Download
    • memory/4084-4-0x0000000000401000-0x000000000040A000-memory.dmp
      Filesize

      36KB

      Download
    • memory/4084-5-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/4084-6-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/4084-0-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/4084-7-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download