Overview

overview

10

Static

static

10

2024-07-10...de.exe

windows7-x64

9

2024-07-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10-07-2024 23:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-10_066efab4006f6d7a54704deeb7ec7a2f_darkside.exe

  • Size

    145KB

  • MD5

    066efab4006f6d7a54704deeb7ec7a2f

  • SHA1

    3d2a9c4a79a803389e84e781325ae3bd1593553e

  • SHA256

    b6c7085f5da7f87147f36513dec7aff1b16583f2a45e388984bf36906e690eda

  • SHA512

    79acd818d804210c83356121ab27e8e29f1aa7fda7d0e210bf8bbe19aceb275c29721933c5801757cc6d11639698fe40c904fbf7994a9f2b60d5ba6dabb50373

  • SSDEEP

    1536:izICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDIYRVAZGB/mEpVQVEl5+mVsXLib:hqJogYkcSNm9V7D3RVAZ8pV2YdVtNlT

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (336) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-10_066efab4006f6d7a54704deeb7ec7a2f_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-10_066efab4006f6d7a54704deeb7ec7a2f_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\ProgramData\83DF.tmp
      "C:\ProgramData\83DF.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\83DF.tmp >> NUL
        3⤵
          PID:1476
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:400

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini
        Filesize

        129B

        MD5

        d09bc26bee6a254e51b6442370071e30

        SHA1

        d9810fed2cea741389c285a8d2e23b0db3c99a43

        SHA256

        2eefab2d089af4459e9cbf582d183dbf2e8cd449913caa6da6405fbd689f897d

        SHA512

        4131fded4f1bdbd78285d505e40776c83dbff9b846e65bc57017a5e73d4c3a96ec20ee58575c6b6df671d15709300fbf8cdf1a0ac5cc36d3242a1b9a182d5419

        Download Submit

      • C:\G1Lm3pdHE.README.txt
        Filesize

        316B

        MD5

        36d2627ddcf4f3914596f51acdc22cb8

        SHA1

        bfc0f2883aaef9158a116aeccc2509f043e5327d

        SHA256

        bd70f025c816220743b402c38f3f7eb218c636c2d7db43763d7952d1ccdcfe03

        SHA512

        699b5039a7ae96187c701aafeda8d9bd87e4045884b95f83f33fad3d8d97377a86c47a6ed1943b88e2098ce63788e91b1db7a2b252a4f716200801689f72f46a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        145KB

        MD5

        6267b448d5a7db5f81da3592eb18c211

        SHA1

        927e2874fa9ed2f15865e778be11231c2dfc6dfe

        SHA256

        010482d0db9b7041014a6dfa276897e6c2f6e695fa9b6573d147fb51a3de42d5

        SHA512

        10809947611315d8dba475b82ca01be399aeb1cbba8c200140c780ce1878bb812d7839105249e4edbc805447f21e97946993b08e3548319690a99cb3388ceb41

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\IIIIIIIIIII
        Filesize

        129B

        MD5

        12fa9243584feb0b4f3e43042d299ab0

        SHA1

        b993c55a401a7fb24e96494ddb7be3f3bf1109a1

        SHA256

        e6f51ef1ded7052611ecd840758171224318d2d4bfee898c33104dd3a58498e9

        SHA512

        96e97c902021923cacdbc1babff323e23197f33445b6cba1be8d0a7910d54b53039893d288b054a21e613161cbfde74c3d1f59873d1aaaae7c1425579af6ebb8

        Download Submit

      • \ProgramData\83DF.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/1768-867-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1768-870-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1768-869-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1768-868-0x00000000002B0000-0x00000000002F0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1768-900-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1768-899-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2824-0-0x00000000022D0000-0x0000000002310000-memory.dmp

        Filesize

        256KB

        Download