Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-06-2024 09:42
General
-
Target
2024-06-24_9c5698924d4d1881efaf88651a304cb3_darkside.exe
-
Size
147KB
-
MD5
9c5698924d4d1881efaf88651a304cb3
-
SHA1
c60a0b99729eb6d95c2d9f8b76b9714411a3a751
-
SHA256
6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417
-
SHA512
1e9cc0d7c831a496e3dbcc56f2d5d477e7a7546c2f223b0278fedfa10fc1bebb0412fd5d81ac02a77aa503ddc99dea1d59d9120d076ae7a0f5137c9260a64eea
-
SSDEEP
3072:+6glyuxE4GsUPnliByocWepMT0CY2gbP39m3Lpdp:+6gDBGpvEByocWeAYTbPN8p
Malware Config
Extracted
C:\flzQgniJJ.README.txt
http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_9c5698924d4d1881efaf88651a304cb3_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_9c5698924d4d1881efaf88651a304cb3_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\2980.tmp"C:\ProgramData\2980.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2980.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a716d0c0450d4bcccf0a46b000691007
SHA1acb219b63d1c5348c2ff8ad58c08865fb2ef4f6e
SHA256f94a8ad44651a506e1e90c6e43db5a948fd0fe81d1f7a3d9735035b7f1dfe165
SHA51217be776b2cb1c31f42eaf73088f6c81bf5d1db1a6963db1604061c231a1f9c58ba9ff5532609b6559c5b260c7a32f0c6021feefce74e865fc22fa762af9649b5
-
Filesize
147KB
MD570a0782fa6dc9ce23532522d3781a79a
SHA14424984be457365644030a7b34f5af8300061741
SHA256ddffbca56c96768c35433b42c6d6d6e175c098e77b45c14681614028fc21e6f9
SHA51203af7b3d29d373f024565d33d24da5528f4396d310be69f7915d816f066255083d8e7dddfd7d582a249c0b5a7d13f55875dbd887378247777e5e2284ad3d2a9c
-
Filesize
1KB
MD53bebb5494e1c3d4753ce92a479e7eda5
SHA1243685d0515d19210e4e2f354d367be6212e98ff
SHA25613d69c85aeb5beab58caefaa2cdc257d668f568103a5cebbd98038b3b66b66bd
SHA5120e31e7bf96fbd6bb91fbe96e59acf96dd0fef5e9db9e93e924afd17fe1066c04b0d9bf9e2d60c335db4f0347107a63d92dfc9ba9b166d2e3151e5440232f63da
-
Filesize
129B
MD5dfd4f5b7a4f3bdcabcc7245b421c53a3
SHA152f5d8ba54975ca4aaac33a4eddab3b0d59997da
SHA25667f239ad7f40ed436dfbe11aa6f8cc004ff8f23977a217f54d6a07ad30ba9da5
SHA512441f8ae70b0fc4f5c6380f914489f641673889fcd3aa6b6cde0dfe0ad2178dedf0e5faf246c7b3aa37b16af24b3b1d91787a91a830fd40c4e80ba10274370fae
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB