Overview

overview

10

Static

static

10

2024-06-08...de.exe

windows7-x64

10

2024-06-08...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-06-2024 06:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-08_6394b78bf0109da21ab4e219125d2c67_darkside.exe

  • Size

    147KB

  • MD5

    6394b78bf0109da21ab4e219125d2c67

  • SHA1

    644e760bf43d414b988e482cec9369ab47f11d16

  • SHA256

    d60bf9ffc43dc0aa3072e080c4c86b05b92d786c7c2aa6822201b90d49247df9

  • SHA512

    48daafa3aab27a388b60a97ed54dfcafa95feeb21afba82923cdc8d713e6671d8f965ac3013eca36db74ce80e4db0cc0387a3538c5404ca987fd7c42caf2167e

  • SSDEEP

    1536:6zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDk6onOmnyJ5kDTDbLx6IWhShx7V:JqJogYkcSNm9V7DkhpUsTDXx6IWMkyT

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\vy276X92o.README.txt

Ransom Note
------Dear managers!------ If you are reading this, it means your network has been attacked. What does that mean? We hacked your network and now all your files, documents, client database, projects and other important data safely encrypted with reliable algorithms. we also have a copy of all your data. WARNING!!! You don't have to go to the POLICE, etc. Otherwise we will not be able to help you. You cannot acces the files right now. But do not worry. You can get it back! It is easy to recover in a few steps. As proof, we can decrypt any 3 files you provide. We are not interested to ruin your business. We want to get ransom and be happy. Please bring this information to your team leaders as soon as possible. In case of a successfull transaction, we will restore your systems within 4-6 hours and also provide security recommendations. -----------------------WARNING----------------------- If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You nedd cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -----------------------RECOVERY----------------------- Use email: [email protected] (Alternate email address: [email protected]) You personal ID: sns54088802500

Signatures

  • Renames multiple (663) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_6394b78bf0109da21ab4e219125d2c67_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_6394b78bf0109da21ab4e219125d2c67_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\ProgramData\B8CC.tmp
      "C:\ProgramData\B8CC.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B8CC.tmp >> NUL
        3⤵
          PID:3580
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4920

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini
        Filesize

        129B

        MD5

        152effe9e00455f8ef143ce4550c0c28

        SHA1

        fc39b941e611e566244a8b747fda8dc088e4901f

        SHA256

        532bcaca6eb4982d93223acab5b7ef5fa77a384d86a069b71bd610af3a71d209

        SHA512

        38214ec80278839f1a3781ad496ac66d655d9c8a0ecfaaf4c547005498f8e04dd68819446b0c4c4df70d866bd7b9c025fe5d110ba292446eb3b255c2b0d407d5

        Download Submit

      • C:\ProgramData\B8CC.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        6ea10a2a469b7390c7b73592cade05b3

        SHA1

        32fc4ae73c72f4de28cb4b0c263717064a9e63c2

        SHA256

        66d661c2fe13c766efeb888cb650022b058ed1a86c7ef657a3b8bfae27fd679d

        SHA512

        48f782ff04f951888bd774152d1adc4f796eb2e1c49bdae0941be9301e3c86a40ad9e134d36355439e5820f76699da1f1dfa1d81e10c1ddcdb23360354c3dc22

        Download Submit

      • C:\vy276X92o.README.txt
        Filesize

        1KB

        MD5

        d3078aa901717aa20f7e0ea822014619

        SHA1

        5d8d966865e200dbf9da737025b70e255b6d96e9

        SHA256

        905452266dcd035898be9a6836a510ed3212e0b7db97e271098831bfc19645be

        SHA512

        e78812de508c12d2ccaab50a9fd1f47d83862b8d01b86c04febed442ba63526e66a6b9553776a7e9b54a236d3e03c0b508232676345560b9a112dc7675264a0c

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        c54ef6ff537d0664c79f6bb5000606c5

        SHA1

        084190806b05fc80a6d3f8813a702f6d177d0296

        SHA256

        81d93c90e7cc1800389dccf00dbd73b0472199f941376fd5bc67e8e79c7800b6

        SHA512

        d1ce457f67c5c7fa16d88f7ab4412c00b2c4c65565cbe49845e0b4da022f1f1f0e93c8611fadef56ac6cc3c196d918f06766e7a050fd87c5e3659e95958a7b3a

        Download Submit

      • memory/1480-2843-0x0000000003350000-0x0000000003360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1480-2841-0x0000000003350000-0x0000000003360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1480-2842-0x0000000003350000-0x0000000003360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1480-2-0x0000000003350000-0x0000000003360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1480-0-0x0000000003350000-0x0000000003360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1480-1-0x0000000003350000-0x0000000003360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4392-2849-0x00000000025B0000-0x00000000025C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4392-2848-0x000000007FE40000-0x000000007FE41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4392-2852-0x000000007FE20000-0x000000007FE21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4392-2851-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4392-2850-0x00000000025B0000-0x00000000025C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4392-2881-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4392-2882-0x000000007FE00000-0x000000007FE01000-memory.dmp

        Filesize

        4KB

        Download