Overview

overview

10

Static

static

10

2024-06-27...de.exe

windows7-x64

10

2024-06-27...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 12:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-27_9d321df9405cb926068b683c6523ea33_darkside.exe

  • Size

    152KB

  • MD5

    9d321df9405cb926068b683c6523ea33

  • SHA1

    d97e101eb8cad867de03bce0034a8a3792924360

  • SHA256

    12474618f58fb808fe514e68e7e686185a9d512e469463f331bcde823e997596

  • SHA512

    ac45f36a2f2107ebae5974bad12eacb5d4a65ed0d116d1a8d677a1d305e76d5bfebf4af006c75b2186eeb000c91201c04877a536b01215307a3be3ac2af110b7

  • SSDEEP

    3072:j6glyuxE4GsUPnliByocWepwiFD78XS9hkEfYL:j6gDBGpvEByocWeyi6XS9hX

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\FSx0EaYuE.README.txt

Ransom Note
RADAR and DISPOSSESSOR TEAM Your network has been breached and all major data were encrypted. Important files have been downloaded from your servers and are ready to be published on Data Leak blogs, DarkWeb forums, Telegram channels etc. To decrypt all the data and prevent exfiltrated corporate/confidential files from your companies network to be disclosed, you should contact with us. We will provide you a proof video how our RADAR Decryption Tool works. Please contact our sales department by “Contact Us” form: https://radar.ltd/contact-us Or via TOR Browser: http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us How to open any .onion website? - For Windows, Mac, and Linux users, you can directly download the Tor Browser from the Official Tor Project website - https://www.torproject.org/download/ then install it on your system. Official guide - https://tb-manual.torproject.org/installation/ What are onion sites? Onion sites are websites on the dark web that use the “.onion” top-level domain instead of “.com,” “.net,” “.gov,” etc. Onion sites use The Onion Router (Tor) software to encrypt their connections and enable anonymous communication. Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete encrypted files. In result your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything and your data, recorded data on videos etc will be published. - Do not hire a recovery company. They can't decrypt files without our Decryption Tool. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail and in result affected company should close their business because of them. You should contact with us yourself and we'll guarantee you 1008F9B97D9B6190041DF806A444D975BF7uccessful decryption with video proofs without any loss + exfiltrated data erasing from our servers. - Do not reject to purchase RADAR Decryptor from us, otherwise exfiltrated files will be publicly disclosed with video of all files. If you will refuse to pay as you should know, that we have direct contact with a list of journalists, law firms and even videosharing company with a website https://cybertube.video , cybernews company https://cybernewsint.com where the news will be published and a list of leak blogs with millions of visitors, where your files will be posted. The next step will be the callings and mailing to contact list of news sites, law firms, your customers and partners with a link to the video, leak blog, news etc In result you may suffer significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. Don't try to hide the situation, it's impossible with us, since our team is professionals with 14 years of experience in cybersecurity area. Our interest is not to harm your company, but to help improve security and we can do this for you. FAQ - https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L News about us - https://socradar.io/dark-web-profile-dispossessor-ransomware/ https://x.com/ransomfeednews/status/1793647035888840759 P.S. Do not repeat the same mistakes as other companies did with us, for example our old case with a small Spain Company: ALVAC S.A. Their Website - https://alvac.es Our media team published files and videos, because they didn't pay as in time. Small part of proofs: https://vimeo.com/752214614 https://hacknotice.com/2022/10/01/alvac-sa/ https://twitter.com/elhackernet/status/1576678217603502080 https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live Lot of telegram channels like https://t.me/elconfidencial , https://t.me/baseleak and all darkweb resources listed here - https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md For ALVAC SA we hired 3rd party team of data analysts with OSINT-specialists. Because of adding such 3rd parties, the price for Decryption Tool and exfiltrated data erasing has been increased. In result they suffered significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. And it will never end for them, as their files are constantly downloaded and videos are viewed by people from all over the World. That's why we don't recommend to ignore us. Let's respect each others time. With best Regards, RADAR and DISPOSSESSOR TEAM
URLs

https://radar.ltd/contact-us

http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us

https://cybertube.video

https://cybernewsint.com

https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L

https://socradar.io/dark-web-profile-dispossessor-ransomware/

https://x.com/ransomfeednews/status/1793647035888840759

https://alvac.es

https://vimeo.com/752214614

https://hacknotice.com/2022/10/01/alvac-sa/

https://twitter.com/elhackernet/status/1576678217603502080

https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live

https://t.me/elconfidencial

https://t.me/baseleak

https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md

Signatures

  • Renames multiple (362) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-27_9d321df9405cb926068b683c6523ea33_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-27_9d321df9405cb926068b683c6523ea33_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\ProgramData\367B.tmp
      "C:\ProgramData\367B.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\367B.tmp >> NUL
        3⤵
          PID:2320
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:2380

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\CCCCCCCCCCC
        Filesize

        129B

        MD5

        91806cdcf761152066400a26601b9207

        SHA1

        751415be464304b25ee1ba0413b90a098ed2b6a8

        SHA256

        f7619d780231563e02fc7853d44b0a67948b6ec2a144f0694dba48a85029fdd4

        SHA512

        86cc3c30024cf5f8a5e96e9da7648f2f2e5d38f0163544b00fdad863fdb730992662499c5d6f40e283f8fbd39a556715600ae2220821440707500b0918771671

        Download Submit

      • C:\FSx0EaYuE.README.txt
        Filesize

        4KB

        MD5

        296957a59854349c95c5e54919c9dc48

        SHA1

        fb69914480e68ab6c2d5403caec555f326d34e26

        SHA256

        77c10638bf86e036e5750e0f2067bbeed349bccf3a60c755ff82344083f2cea7

        SHA512

        94cdc5fa87f459cedca3aeb3e2d236c568008699c4fe6f6d31e762f8ff60eac60879a77f18bb689ff360c517181c84c10996731c03446217375525893d2f435c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        152KB

        MD5

        48ae68e1f5fc78c5388e9f98a0a5a42c

        SHA1

        2790f8173dcbff6ec0a824d085ae2dc6ec3ea853

        SHA256

        691ca7b81b3c212e8b220bcb9fe284fd526e5e6cf14278510bdf5321a421acaa

        SHA512

        4a91ca087524657d9bf70a92de002f1b73b0deb76b178dd9161d76fa0c87f7379212c0aec28491c8736214c7414d9d9bbc7bda23d9868c1d4ee30b18bd13dfc2

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        537a3514a46c73692c68fb0a5ae27792

        SHA1

        49cfa20cb0b440a6f93495241795060a60b1fc0a

        SHA256

        3f0a41f349f3980d58656782dff98fa7e123bb94c7da4ae479a747524d9029df

        SHA512

        460f28cb5143f56f2f2d0ff1cbf96fbd937a7541dfa0b1b1f5d712f30e7aeaa0186feeb4c2e60cfabba706f234f946d75a5bd413ce5fc19d5799f58966977c0b

        Download Submit

      • \ProgramData\367B.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/1160-899-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1160-898-0x0000000002290000-0x00000000022D0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1160-897-0x0000000002290000-0x00000000022D0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1160-896-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1160-900-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1160-930-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1160-929-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2164-0-0x0000000000CF0000-0x0000000000D30000-memory.dmp

        Filesize

        256KB

        Download