Overview

overview

10

Static

static

10

2024-07-10...de.exe

windows7-x64

9

2024-07-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    77s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10-07-2024 23:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-10_407ce6cf7b3ca16443b0b5eb49c01b3c_darkside.exe

  • Size

    145KB

  • MD5

    407ce6cf7b3ca16443b0b5eb49c01b3c

  • SHA1

    4c7a95bc4e92110f8ec7e050fb2c6f519f94dcc0

  • SHA256

    870da2dea3d586ccaa3230464b910704460f354afdd417587a167735e478b0be

  • SHA512

    a5aedc10cf1e7abf1491b7a680f5ecd2b07975fc2d0f859f4f277ff55b8899fd0402e949a81c20b660026a28a24565f2119386ed3e882886f2141a904fa0cb34

  • SSDEEP

    3072:yqJogYkcSNm9V7DMr3lW1mOXY6pcphw9k8nT:yq2kc4m9tDOqno6pb9k8

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (809) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-10_407ce6cf7b3ca16443b0b5eb49c01b3c_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-10_407ce6cf7b3ca16443b0b5eb49c01b3c_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\ProgramData\1F15.tmp
      "C:\ProgramData\1F15.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1F15.tmp >> NUL
        3⤵
          PID:2576
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x154
      1⤵
        PID:2384

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini
        Filesize

        129B

        MD5

        cfc07d47a72bd7b2041ef82ed5a1687b

        SHA1

        4a54f10af833b93bdb202fe287d5255b18d469ac

        SHA256

        ca23504ca716868de74da9b053d02892991e1ca073e1b7bd0f9388a269900ac5

        SHA512

        c8442ddd434aedc057f911b6bbec437a36852455709f661f54be96f61e554da666ca209bbb969b5248c24dbbcac133fbbdfd28902ab68ee64d78a576fd29da9c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        145KB

        MD5

        c28a0fad1766ca249e76c4a27b7b09a9

        SHA1

        63b7c9d2b5da84ad2c3c6a2ea688b21c57343af2

        SHA256

        6342c33b29cd35412cdecb7d34c84efdc07a355366d7537b869627fc54a7e18f

        SHA512

        75d7e73425c86da1c97c174b78c2a00b5fdb48baec7d78eab091c6100a17225165fb796d1fc1819a67a6638a4ec63f837aadc6cf12feaed830f27bffb434d0de

        Download Submit

      • C:\Yv70tJwEA.README.txt
        Filesize

        316B

        MD5

        4169f2df47100f9a98058a8e291df2a0

        SHA1

        5ac334451343f2389bd1ccbac26fccaaf12d3f70

        SHA256

        129378257ff167c2773d1f74ab078a21c4a41ceb8cbdb61f2ef9c5377cb1363b

        SHA512

        3d84b598277533c241097191a11761ff1eedd132539c47f6a305a3cbd95b59022e2fc5345e930e8faf9985f80554b2aa620e79dd312d7e1ee80cfe33f1b9f872

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-2212144002-1172735686-1556890956-1000\AAAAAAAAAAA
        Filesize

        129B

        MD5

        4f0ff8a1c0697c700e05a78d154b4ddd

        SHA1

        34b52a12671a643d70fc4e206b3b482b9351188a

        SHA256

        6ddbc71e19081ba214892fb6c60abb0e14452280c94c99503acb374492547fee

        SHA512

        a0100f728a304f8f1fe6989972a352d6a78f7eb069cebdf8f25d821eb6e91e3d9cb5807fe17b4cc7167c6a11ce6c732e0659c8929447507fd4a7a5d18c436de3

        Download Submit

      • \ProgramData\1F15.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/980-3589-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

        Download

      • memory/980-3591-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2364-0-0x00000000023F0000-0x0000000002430000-memory.dmp

        Filesize

        256KB

        Download