Overview

overview

10

Static

static

10

2024-07-05...de.exe

windows7-x64

9

2024-07-05...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06-07-2024 00:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-05_28516542f607440d0e58e211163f3e71_darkside.exe

  • Size

    147KB

  • MD5

    28516542f607440d0e58e211163f3e71

  • SHA1

    8932290b8859c41bbdab2f3edc89223e0584c3bc

  • SHA256

    6338cb84816874aa4365f23aac592ef3b0ead42975b0a8fa8cdac554fc11dd6a

  • SHA512

    231c0dc144c1af65e1309f068174c18d11fd371942472d0a994f856df1cb30c889a00a80b70448509ec91ae4c3e7c8215eb242be9ed8ba799beef98d700bccdb

  • SSDEEP

    3072:p6glyuxE4GsUPnliByocWepBaCB8b8UGrr:p6gDBGpvEByocWezOlC

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (337) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-05_28516542f607440d0e58e211163f3e71_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-05_28516542f607440d0e58e211163f3e71_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\ProgramData\81BD.tmp
      "C:\ProgramData\81BD.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\81BD.tmp >> NUL
        3⤵
          PID:1580
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:2712

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini
        Filesize

        129B

        MD5

        b02a9927894a503b1cbaf1f2490823be

        SHA1

        0d6590ef45e1ad139fe880a16d08e8b9895f80e8

        SHA256

        a4a093e91653444d3b5f63433261accf6a0a9909a444b75d87dd5bc8f388cdee

        SHA512

        07fb645166f9b6fe5b2df4e1f2eb4b34f18aa016db829acec50bb2e79be15fd49c1881d3d3dd374915a7ca349fecb09ddcd4565cd1590b90318c314b2ade5a0b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        9fd553ed2b6100fc4f407342857a68fa

        SHA1

        792d6ada0fe07575200e7313ad40a523339ecbd6

        SHA256

        2902c3dd27dcbeafbee8b498ea1d44829d59a9a63d3a764d95d1cbabe0eb3e5c

        SHA512

        7bed240df47ae854e741d7703ac54d8c48d23fe77f41cfef0f88a26148b80b9d9b19f1123a453a6e700230a484bd09fc9d9a22aef28b6390d21ac0108a611236

        Download Submit

      • C:\jK8voaKLl.README.txt
        Filesize

        1KB

        MD5

        fe260d259877d978c354c152a4afd9ee

        SHA1

        0558c0c395b6a1d1e1ea6249cb8c753510895271

        SHA256

        86b4b2c76bdce0ac995ead72a55f6aa04a8f387f43559c95c1b39c4c10b18603

        SHA512

        4bf013d0b05482602dfb6415fce225043158f978c4d17b1d7f5835e52e30c62db5cc990adc9bc6a3895f71b45a64facffa6552cb096a08fb0a1acd6d59635b64

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        271a8c044937a9f5cb0c4c24342af924

        SHA1

        a485886585f5f96468b7c166630ee4f7f3d1d13b

        SHA256

        fdbd828293506d260bc259a66c97da130403a618aa98d7cf029b9478b2ee5d5c

        SHA512

        7e6ca0de04f34829a1f6b9cde12e51a0411c96ebf0283f59010f0bf72c4963dcdf7c919eb00384da111961e8256c465d1330d1c8fcd2fb945cfc88d8ff65d60c

        Download Submit

      • \ProgramData\81BD.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/2292-870-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

        Download

      • memory/2292-872-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2876-0-0x00000000001E0000-0x0000000000220000-memory.dmp

        Filesize

        256KB

        Download