Overview

overview

10

Static

static

10

2024-07-09...de.exe

windows7-x64

10

2024-07-09...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09-07-2024 19:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-09_819e99fcbe582443daf3dc7605bdba4e_darkside.exe

  • Size

    147KB

  • MD5

    819e99fcbe582443daf3dc7605bdba4e

  • SHA1

    1ca7a6d96ad09704adf068b34848e3db9aafe4f0

  • SHA256

    76bab2ddaa0159d1a379e896581dca9675f1ef51bf31194fd4e85ab06ad75562

  • SHA512

    62aeab27b40dd7a6b7e3f981911c750a056fcad247ad40fe470dbe94bf07d0a186a01dfdc1eb81f9ae78dd7eb2b724214eb87948ed1f8579c4f74b75611ee4ea

  • SSDEEP

    3072:K6glyuxE4GsUPnliByocWep3QqGp3VeTBAPpk2pjPdZ8Y:K6gDBGpvEByocWeOqG/5kiPdZ8

Score
10/10
lockbitransomwarespywarestealer

Malware Config

Extracted

Path

C:\1VDsMQg1G.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom CONTACT US AT Telegram:@anon3621 Chat Link:t.me/anon3621 >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID:92361C35E31C9012FBC19BCA4F120F069CB80 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay in 48H we will publish all your data to the dark web! >>>> Payment amount is 25$ only at once >>>> BTC: 1HBg3gNYrqLGDoXyxBEsakTwodUzP3xje >>>> ETH: 0x1330e56e0051ad34a21ac06d84dceb48cf55db62 >>>> USDT: TC5K4qWnM5Y1GBHTfTMemGLmRVuTGNs61K
Wallets

1HBg3gNYrqLGDoXyxBEsakTwodUzP3xje

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Renames multiple (9074) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-09_819e99fcbe582443daf3dc7605bdba4e_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-09_819e99fcbe582443daf3dc7605bdba4e_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\ProgramData\6BBE.tmp
      "C:\ProgramData\6BBE.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6BBE.tmp >> NUL
        3⤵
          PID:2740
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:2696

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\AAAAAAAAAAA
        Filesize

        129B

        MD5

        3e86c60651463493da7ec93327642c25

        SHA1

        b82a7d900d25ac82453cb9d4630e4d11a63d26b6

        SHA256

        e5ed68a938e3e3cef2ab3534956a98e5ab36799a2a1f4d0e0ef1c4e2ed194ba1

        SHA512

        62bfa8266981d557db0ce1d06b4f4667d20391092b027916985f731e464b8e7648ab1bf4001a309d7b58bc643918ff0e5507bf7e84672e3294f36c2da45b2c15

        Download Submit

      • C:\1VDsMQg1G.README.txt
        Filesize

        1KB

        MD5

        bd8cf79de3c63b14e030c1cbe02aade3

        SHA1

        d0416fa4a64071673ea60516cc0ead21456ca0ca

        SHA256

        26661666998940603290022f0bef83f16f9c02b1317a6a81fb93c46a23f4c471

        SHA512

        9c3b8cb5b4fc44effa155fdd6576d6948b3c28405ebeb2016cfb84241b3d6344d6a8a1cbd3919ced6528897a1238a946534756418c6d52e01457a0aacb9cee59

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        2672125d2babb2fa9f0dff9058837c0f

        SHA1

        28b91f25bb5e51edd5068f4f2ca9f17ba596afcb

        SHA256

        991da396cd1bac3fbc830c7fbd38aefe51c2d58982ca1bc5eb20147e3a234dac

        SHA512

        098547f41a9cfd082d23fe18f0cfdd6bcc34f00b44ea5aabdc3df8c05681d0d9e5a749b43ef6398e5d18b5fbcd5e0e612d362711885094a4b6473caa4f6fe309

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\CCCCCCCCCCC
        Filesize

        129B

        MD5

        385fd898c7121bda51c05d9e0103f254

        SHA1

        140d55f879d217ca6e526ef4d9aaf385d3ab7704

        SHA256

        e6059f95d8cc961598fcece2816b74b45feacf453022211ca31d53e552efc50d

        SHA512

        cecc8a9eb188377b7a7e3b36839fe4747af496aa80a7d6a2513bcd19d881d2cd0e3b0b9c507262aebac1edf1152ad31a9f977def97366d16f35eaaa2aba4da27

        Download Submit

      • \ProgramData\6BBE.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/1676-12917-0x0000000000390000-0x00000000003D0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1676-12919-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1676-12918-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1676-12916-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1676-12949-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1676-12948-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2384-0-0x0000000000570000-0x00000000005B0000-memory.dmp

        Filesize

        256KB

        Download