Overview

overview

10

Static

static

10

2024-06-08...de.exe

windows7-x64

10

2024-06-08...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    08-06-2024 06:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-08_6394b78bf0109da21ab4e219125d2c67_darkside.exe

  • Size

    147KB

  • MD5

    6394b78bf0109da21ab4e219125d2c67

  • SHA1

    644e760bf43d414b988e482cec9369ab47f11d16

  • SHA256

    d60bf9ffc43dc0aa3072e080c4c86b05b92d786c7c2aa6822201b90d49247df9

  • SHA512

    48daafa3aab27a388b60a97ed54dfcafa95feeb21afba82923cdc8d713e6671d8f965ac3013eca36db74ce80e4db0cc0387a3538c5404ca987fd7c42caf2167e

  • SSDEEP

    1536:6zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDk6onOmnyJ5kDTDbLx6IWhShx7V:JqJogYkcSNm9V7DkhpUsTDXx6IWMkyT

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\vy276X92o.README.txt

Ransom Note
------Dear managers!------ If you are reading this, it means your network has been attacked. What does that mean? We hacked your network and now all your files, documents, client database, projects and other important data safely encrypted with reliable algorithms. we also have a copy of all your data. WARNING!!! You don't have to go to the POLICE, etc. Otherwise we will not be able to help you. You cannot acces the files right now. But do not worry. You can get it back! It is easy to recover in a few steps. As proof, we can decrypt any 3 files you provide. We are not interested to ruin your business. We want to get ransom and be happy. Please bring this information to your team leaders as soon as possible. In case of a successfull transaction, we will restore your systems within 4-6 hours and also provide security recommendations. -----------------------WARNING----------------------- If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You nedd cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -----------------------RECOVERY----------------------- Use email: [email protected] (Alternate email address: [email protected]) You personal ID: sns54088802500

Signatures

  • Renames multiple (338) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_6394b78bf0109da21ab4e219125d2c67_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_6394b78bf0109da21ab4e219125d2c67_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\ProgramData\2F4A.tmp
      "C:\ProgramData\2F4A.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2F4A.tmp >> NUL
        3⤵
          PID:1512
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:2332

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini
        Filesize

        129B

        MD5

        729203419c0d17feaef9f7858ea507e7

        SHA1

        5eefa69247e0858097dec758e9ba47ab648c15b4

        SHA256

        4c8249cc3e4e9e3c47d8fac98b6873842b5f2f65d8ae252a355fede9c0d46c5c

        SHA512

        d2a05c0f5692cb8e275f71e1f6d15b1a6d959e731364a716dea4effe871b1199773cdf8ea8c146cb0da74e52adaaf00978ccac170fca775841a102f17686a939

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        2d868e87d798ac3b6e95e85f3711f3b9

        SHA1

        94a6fadb84b7c56e663b044eef003b487d93b3f3

        SHA256

        fac2cec409102d5c45ae18824bf2340e7646e49a4c2444f1587cf693323d5128

        SHA512

        84aa79f37f2b334e7b4a68ac57e04dd39eef05df804f7d0be7e93fa99461870ba759f7302806a535a8bdf09b08c994c4480155debbb1bc4791caa256af2a4dc3

        Download Submit

      • C:\vy276X92o.README.txt
        Filesize

        1KB

        MD5

        d3078aa901717aa20f7e0ea822014619

        SHA1

        5d8d966865e200dbf9da737025b70e255b6d96e9

        SHA256

        905452266dcd035898be9a6836a510ed3212e0b7db97e271098831bfc19645be

        SHA512

        e78812de508c12d2ccaab50a9fd1f47d83862b8d01b86c04febed442ba63526e66a6b9553776a7e9b54a236d3e03c0b508232676345560b9a112dc7675264a0c

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        8440aaff82f3317c5178613c9a1ea2c8

        SHA1

        ead847e4e0310ea2fe27b411e192c0db91366c0c

        SHA256

        3194f9cca2e4b45559ae82596174abbe1389a9b8175c3a113cd927a1d1a03196

        SHA512

        53bcf352ab0a3497ccb07f397184485fd059412fd7ed7d55f4fa03c83a2b076d8356ee510f75ada80ed095abf56a2bcbdabb26d03b71b73365b731f13fe49aaa

        Download Submit

      • \ProgramData\2F4A.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/1288-868-0x00000000002D0000-0x0000000000310000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1288-870-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1288-869-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1288-867-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1288-900-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1288-899-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1780-0-0x00000000022C0000-0x0000000002300000-memory.dmp

        Filesize

        256KB

        Download