Overview

overview

10

Static

static

10

2024-07-10...de.exe

windows7-x64

9

2024-07-10...de.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-07-10_066efab4006f6d7a54704deeb7ec7a2f_darkside

  • Size

    145KB

  • Sample

    240710-3pegrswfqj

  • MD5

    066efab4006f6d7a54704deeb7ec7a2f

  • SHA1

    3d2a9c4a79a803389e84e781325ae3bd1593553e

  • SHA256

    b6c7085f5da7f87147f36513dec7aff1b16583f2a45e388984bf36906e690eda

  • SHA512

    79acd818d804210c83356121ab27e8e29f1aa7fda7d0e210bf8bbe19aceb275c29721933c5801757cc6d11639698fe40c904fbf7994a9f2b60d5ba6dabb50373

  • SSDEEP

    1536:izICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDIYRVAZGB/mEpVQVEl5+mVsXLib:hqJogYkcSNm9V7D3RVAZ8pV2YdVtNlT

Score
10/10
lockbitransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-07-10_066efab4006f6d7a54704deeb7ec7a2f_darkside

    • Size

      145KB

    • MD5

      066efab4006f6d7a54704deeb7ec7a2f

    • SHA1

      3d2a9c4a79a803389e84e781325ae3bd1593553e

    • SHA256

      b6c7085f5da7f87147f36513dec7aff1b16583f2a45e388984bf36906e690eda

    • SHA512

      79acd818d804210c83356121ab27e8e29f1aa7fda7d0e210bf8bbe19aceb275c29721933c5801757cc6d11639698fe40c904fbf7994a9f2b60d5ba6dabb50373

    • SSDEEP

      1536:izICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDIYRVAZGB/mEpVQVEl5+mVsXLib:hqJogYkcSNm9V7D3RVAZ8pV2YdVtNlT

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (336) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks