Overview

overview

10

Static

static

10

2024-07-10...de.exe

windows7-x64

9

2024-07-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10-07-2024 23:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-10_c800abb5601665aee11296a490208235_darkside.exe

  • Size

    145KB

  • MD5

    c800abb5601665aee11296a490208235

  • SHA1

    075f5904a79191e0e1bf55dead50436e79240211

  • SHA256

    d2f92f8689ebe1eca79c8bdd1c14d0b132ffc69df2d8b1edcfa5ce8ede390085

  • SHA512

    9fa5d90077e0ebae8d10542ac3e7b4d6fd49c84c1995f3b2e3a99db8932d82590b4de6711c6f49d4f954f760b5d6c4c5c1aa4a0b5d123ea6086549a22c741ae2

  • SSDEEP

    3072:uqJogYkcSNm9V7D2xZ11Z/pBOlKkv1Rfn5T:uq2kc4m9tD2D1LRBsxB

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (344) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-10_c800abb5601665aee11296a490208235_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-10_c800abb5601665aee11296a490208235_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\ProgramData\D874.tmp
      "C:\ProgramData\D874.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:828
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D874.tmp >> NUL
        3⤵
          PID:2860
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x148
      1⤵
        PID:3060

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini
        Filesize

        129B

        MD5

        f59507a6a3ef1e3d198901d1ae0b1846

        SHA1

        2b7d162f143e552a0977ba8181d92fbbaf53a660

        SHA256

        2f3a4269d6c2bf21e1de57d91c719ea26851076f13702f379a543d52dbe34bce

        SHA512

        fa80e8d6eab9c99307a877f0cdfd26864b9a78c3c514eae4eb33ea566a54c713a3a8cfa185e87c40e7c4ce4a21eaeaa17a32d02c1f2844d4b34a03d4b8b6b899

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        145KB

        MD5

        b42b4690145184528227d4dbf5186844

        SHA1

        9358666c53161b776c0e3980df6cafc8bb7a6058

        SHA256

        533b58d23cc4489784ef59495392da0e8896453d0abea6172150451837a04f3d

        SHA512

        341786896665adf7848d3a2c9ff68544d924c8516c0921a584997fb22bff1d782aa7af49b4fa65a72cc69787a6ab364232c6f1fcf983c3eb9292833b181a0d77

        Download Submit

      • C:\iQqkpF2D8.README.txt
        Filesize

        316B

        MD5

        08a63ac77aa5ea8d50ea4db49f31d6d2

        SHA1

        2b61aff1f3510023b5ec9a3f4332b78bfff469e4

        SHA256

        27e2dbc690fb3496c4822a2a1f2a6f33c5308804fe18cdd607cccfd533d7a3c7

        SHA512

        39c7a4b6cb0e45db6ccf4f6dce5a0b11febea1f2c52fffa6ad3496ef993b5ddc23a2e97f2b2e2a2636574c9e25c7abf74fe1d8a79a9b804fafe2a1d37a4fe76a

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-1385883288-3042840365-2734249351-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        8df5c1b511779328aaf2995b8d21b3b2

        SHA1

        0011ff696ba9666496b81d3b4f444fb26d6f4f99

        SHA256

        375e8693eab79795953b0a3d6558ac944c7c6250b4e79751e4aa35e87ff0f16e

        SHA512

        db190d6642f81d1046fdd68429249a211f3721c30dc7137cd373944f2b1f5dfb04ff41ebd7a303e58dd67dd9beb53c733e7a7a4d5b26c6f59afa07a7a82ea5d5

        Download Submit

      • \ProgramData\D874.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/828-874-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

        Download

      • memory/828-876-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2128-0-0x0000000002120000-0x0000000002160000-memory.dmp

        Filesize

        256KB

        Download