Overview

overview

10

Static

static

10

2024-06-24...de.exe

windows7-x64

10

2024-06-24...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-06-2024 09:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-24_9c5698924d4d1881efaf88651a304cb3_darkside.exe

  • Size

    147KB

  • MD5

    9c5698924d4d1881efaf88651a304cb3

  • SHA1

    c60a0b99729eb6d95c2d9f8b76b9714411a3a751

  • SHA256

    6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417

  • SHA512

    1e9cc0d7c831a496e3dbcc56f2d5d477e7a7546c2f223b0278fedfa10fc1bebb0412fd5d81ac02a77aa503ddc99dea1d59d9120d076ae7a0f5137c9260a64eea

  • SSDEEP

    3072:+6glyuxE4GsUPnliByocWepMT0CY2gbP39m3Lpdp:+6gDBGpvEByocWeAYTbPN8p

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\flzQgniJJ.README.txt

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: uYrTA6hpRFsWQR0nqlFk5WK8S+zUIHNd9T3L6aykdR27ztPJwC3xHOsdSBkZhmr+yKcnVLCct0ffjVRy5yvFQydzhzQWJR Email to support: [email protected]
URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-24_9c5698924d4d1881efaf88651a304cb3_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-24_9c5698924d4d1881efaf88651a304cb3_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\ProgramData\ED7D.tmp
      "C:\ProgramData\ED7D.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:60
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\ED7D.tmp >> NUL
        3⤵
          PID:3656
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1032,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
      1⤵
        PID:4360

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\AAAAAAAAAAA
        Filesize

        129B

        MD5

        81c85f8a799749bf65d63cba576bc2e2

        SHA1

        8e49afd9c787c6aa55e01438479f0df085d30a31

        SHA256

        77b5b42b8074cb49806a61c2b46a6a05fce665e842c8f96a2ad468f6db8a8562

        SHA512

        577e1b1cbf9a5f6ce29692240fb586f91570c73f5a20af7636c8c481735f252b1af69b128989c37dbb02f731f734090ca0fd469d82411d8fa2bd7cb39f5e71fb

        Download Submit

      • C:\ProgramData\ED7D.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        aa868fd2b13d21a1f417f47bf63a91ac

        SHA1

        d5eeeb0a1a8be28ed7a5dada6cd4fa56b2a69dca

        SHA256

        4dcef76a9c90cffe3177a831488b0f7800a32823e99425e9f55ef1f93a677636

        SHA512

        4cbb99aecfb9f63f143ba6b30199bc9690a07b85db4b164bd44bb3adcca36f7d466809e034607f3f874c1ff0e7cfc90e520213697115de6c9f178850d42bc664

        Download Submit

      • C:\flzQgniJJ.README.txt
        Filesize

        1KB

        MD5

        3bebb5494e1c3d4753ce92a479e7eda5

        SHA1

        243685d0515d19210e4e2f354d367be6212e98ff

        SHA256

        13d69c85aeb5beab58caefaa2cdc257d668f568103a5cebbd98038b3b66b66bd

        SHA512

        0e31e7bf96fbd6bb91fbe96e59acf96dd0fef5e9db9e93e924afd17fe1066c04b0d9bf9e2d60c335db4f0347107a63d92dfc9ba9b166d2e3151e5440232f63da

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3665033694-1447845302-680750983-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        534886d3307448fba332fd3d507d2d30

        SHA1

        518edd7257dd73518ae9a1da3e6e30eeef49cf25

        SHA256

        aeaa598f3320064f943511e19b3472688879d8c9f794e39cff81c33bbc958d99

        SHA512

        18d09ad60de9421c59795c237e42c1f6a703203c18f8fe750d239e717c1e9cc6a4a2fc127585b9f8c7430916d0bcc36cf90bb164141dd47ffe6fcbaf10d4fa67

        Download Submit

      • memory/60-3034-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/60-3030-0x000000007FE40000-0x000000007FE41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/60-3033-0x000000007FE20000-0x000000007FE21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/60-3032-0x0000000002520000-0x0000000002530000-memory.dmp

        Filesize

        64KB

        Download

      • memory/60-3031-0x0000000002520000-0x0000000002530000-memory.dmp

        Filesize

        64KB

        Download

      • memory/60-3063-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/60-3064-0x000000007FE00000-0x000000007FE01000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5068-0-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/5068-2-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/5068-1-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

        Download