Overview

overview

10

Static

static

10

2024-06-27...de.exe

windows7-x64

10

2024-06-27...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 12:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-27_9d321df9405cb926068b683c6523ea33_darkside.exe

  • Size

    152KB

  • MD5

    9d321df9405cb926068b683c6523ea33

  • SHA1

    d97e101eb8cad867de03bce0034a8a3792924360

  • SHA256

    12474618f58fb808fe514e68e7e686185a9d512e469463f331bcde823e997596

  • SHA512

    ac45f36a2f2107ebae5974bad12eacb5d4a65ed0d116d1a8d677a1d305e76d5bfebf4af006c75b2186eeb000c91201c04877a536b01215307a3be3ac2af110b7

  • SSDEEP

    3072:j6glyuxE4GsUPnliByocWepwiFD78XS9hkEfYL:j6gDBGpvEByocWeyi6XS9hX

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\FSx0EaYuE.README.txt

Ransom Note
RADAR and DISPOSSESSOR TEAM Your network has been breached and all major data were encrypted. Important files have been downloaded from your servers and are ready to be published on Data Leak blogs, DarkWeb forums, Telegram channels etc. To decrypt all the data and prevent exfiltrated corporate/confidential files from your companies network to be disclosed, you should contact with us. We will provide you a proof video how our RADAR Decryption Tool works. Please contact our sales department by “Contact Us” form: https://radar.ltd/contact-us Or via TOR Browser: http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us How to open any .onion website? - For Windows, Mac, and Linux users, you can directly download the Tor Browser from the Official Tor Project website - https://www.torproject.org/download/ then install it on your system. Official guide - https://tb-manual.torproject.org/installation/ What are onion sites? Onion sites are websites on the dark web that use the “.onion” top-level domain instead of “.com,” “.net,” “.gov,” etc. Onion sites use The Onion Router (Tor) software to encrypt their connections and enable anonymous communication. Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete encrypted files. In result your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything and your data, recorded data on videos etc will be published. - Do not hire a recovery company. They can't decrypt files without our Decryption Tool. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail and in result affected company should close their business because of them. You should contact with us yourself and we'll guarantee you 1008F9B97D9B619004168A31E1E3AAB625Fuccessful decryption with video proofs without any loss + exfiltrated data erasing from our servers. - Do not reject to purchase RADAR Decryptor from us, otherwise exfiltrated files will be publicly disclosed with video of all files. If you will refuse to pay as you should know, that we have direct contact with a list of journalists, law firms and even videosharing company with a website https://cybertube.video , cybernews company https://cybernewsint.com where the news will be published and a list of leak blogs with millions of visitors, where your files will be posted. The next step will be the callings and mailing to contact list of news sites, law firms, your customers and partners with a link to the video, leak blog, news etc In result you may suffer significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. Don't try to hide the situation, it's impossible with us, since our team is professionals with 14 years of experience in cybersecurity area. Our interest is not to harm your company, but to help improve security and we can do this for you. FAQ - https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L News about us - https://socradar.io/dark-web-profile-dispossessor-ransomware/ https://x.com/ransomfeednews/status/1793647035888840759 P.S. Do not repeat the same mistakes as other companies did with us, for example our old case with a small Spain Company: ALVAC S.A. Their Website - https://alvac.es Our media team published files and videos, because they didn't pay as in time. Small part of proofs: https://vimeo.com/752214614 https://hacknotice.com/2022/10/01/alvac-sa/ https://twitter.com/elhackernet/status/1576678217603502080 https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live Lot of telegram channels like https://t.me/elconfidencial , https://t.me/baseleak and all darkweb resources listed here - https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md For ALVAC SA we hired 3rd party team of data analysts with OSINT-specialists. Because of adding such 3rd parties, the price for Decryption Tool and exfiltrated data erasing has been increased. In result they suffered significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. And it will never end for them, as their files are constantly downloaded and videos are viewed by people from all over the World. That's why we don't recommend to ignore us. Let's respect each others time. With best Regards, RADAR and DISPOSSESSOR TEAM
URLs

https://radar.ltd/contact-us

http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us

https://cybertube.video

https://cybernewsint.com

https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L

https://socradar.io/dark-web-profile-dispossessor-ransomware/

https://x.com/ransomfeednews/status/1793647035888840759

https://alvac.es

https://vimeo.com/752214614

https://hacknotice.com/2022/10/01/alvac-sa/

https://twitter.com/elhackernet/status/1576678217603502080

https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live

https://t.me/elconfidencial

https://t.me/baseleak

https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md

Signatures

  • Renames multiple (634) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-27_9d321df9405cb926068b683c6523ea33_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-27_9d321df9405cb926068b683c6523ea33_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:1892
    • C:\ProgramData\13F1.tmp
      "C:\ProgramData\13F1.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\13F1.tmp >> NUL
        3⤵
          PID:692
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4188,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
      1⤵
        PID:828
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
        1⤵
          PID:3068
        • C:\Windows\system32\printfilterpipelinesvc.exe
          C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
          1⤵
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:1692
          • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
            /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{418AEC69-0A3A-4907-AE55-2D2F93157B80}.xps" 133639658674520000
            2⤵
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious use of SetWindowsHookEx
            PID:3312

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\PPPPPPPPPPP
          Filesize

          129B

          MD5

          03ae121466052cdc49aed8dd45022bd9

          SHA1

          0fd1993cc485235f335790245f757248fd4cefa7

          SHA256

          a2448f7b39e61bd13022198281e469cb47842a5d9f5f0771aafec4d5f91c7295

          SHA512

          f6149a473c207af9be1efc7c6da3f4c62f69448af28e9fb9ce4885a2fe74f85ce175084f9e33f04e5ae6e533ea7d370fe035b4dad741831963bdd4753a2f351f

          Download Submit

        • C:\FSx0EaYuE.README.txt
          Filesize

          4KB

          MD5

          9faf9305f1f805ffc7b881321e63a996

          SHA1

          a40c68bda510f370c5b716306235f336f59808af

          SHA256

          8262859a0894da8540a8f9716ef6463b3d1834b987dbc8aa51e78c7a0ec2620d

          SHA512

          4e61edea890eb69db9de1024b295228f331428fb6893746e0a3b85f455877534d501ce171b0043288d23896639d28d607ca3b0fb2ea2a0185247b63d4d438173

          Download Submit

        • C:\ProgramData\13F1.tmp
          Filesize

          14KB

          MD5

          294e9f64cb1642dd89229fff0592856b

          SHA1

          97b148c27f3da29ba7b18d6aee8a0db9102f47c9

          SHA256

          917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

          SHA512

          b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
          Filesize

          152KB

          MD5

          7a855378cac0bc39d8fa4c9c1f966c8d

          SHA1

          a5c405c46eb7dd28bba414876c9c8dd2e67ac0b8

          SHA256

          544426e37820590d90897f0a74e960d7b352efe1414fa768519437fb3d8daf24

          SHA512

          1bc6063202dd9cc838ffe8e8b6f68a41d4289bccce1d1f95d84e57a5bae8903f403582b85badac56e607f9d24d40264c9ca67c4e3dccc7d20542871b5e1ee576

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\{3B22C23A-6124-4843-A215-F5BBCFB45C81}
          Filesize

          4KB

          MD5

          169c7216610e784757b608f61576914f

          SHA1

          becba3d9439801a637733f32ea2fbc21c0ed61c6

          SHA256

          722fb1836c46dd06a912c0d6764a397c5bf0e56f6f12dbd411575355ab894c46

          SHA512

          65531654e40c50317492f0d729525a11445fb5e8f07eb03d580e0d701cbe161faaad58c93eff18f6411a46cb7bc7bcb17b9fc0d280aec28dccee667347c308b2

          Download Submit

        • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
          Filesize

          4KB

          MD5

          f1098952dd75020b4f222f377caf5657

          SHA1

          a884ea5966ece9dc562b27c0d4832d75cabeb0a7

          SHA256

          d3dd22bd47e31c4f054d891dfe6c8b6762c3ded915e117de4f3609fb6aacb4fc

          SHA512

          7d34c88cc5c14f5c875b783b00e58eb5b2db50bbaf33c24977b5f4445b6b1d7a45a6a10a62032562339d5c95fea77ffb97db66ccb20562206b32970385558ba2

          Download Submit

        • F:\$RECYCLE.BIN\S-1-5-21-3665033694-1447845302-680750983-1000\DDDDDDDDDDD
          Filesize

          129B

          MD5

          b6a6f07dddff217b58bc575b63f188d0

          SHA1

          d455fba565ba479489b573c23cd4e0a411ad7a67

          SHA256

          f03e5d5aece6a2d061ed79f8d576e23461016f78513f4928affcaa08df939130

          SHA512

          890741e78f5b53da2037d309e2c506b83d1e67f52277c984bbaab2f4b0e470d1bb2215c9026bf81dd910ccf17ca41da9c48d26f16c1fb9a7931d0c33b201a01c

          Download Submit

        • memory/3312-3058-0x00007FF946E90000-0x00007FF946EA0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3312-3060-0x00007FF946E90000-0x00007FF946EA0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3312-3061-0x00007FF946E90000-0x00007FF946EA0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3312-3062-0x00007FF946E90000-0x00007FF946EA0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3312-3059-0x00007FF946E90000-0x00007FF946EA0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3312-3092-0x00007FF944960000-0x00007FF944970000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3312-3093-0x00007FF944960000-0x00007FF944970000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4952-1-0x0000000002C30000-0x0000000002C40000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4952-0-0x0000000002C30000-0x0000000002C40000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4952-2-0x0000000002C30000-0x0000000002C40000-memory.dmp

          Filesize

          64KB

          Download