Overview

overview

10

Static

static

10

2024-07-10...de.exe

windows7-x64

9

2024-07-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10-07-2024 23:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-07-10_d3d64f02fda9af093df2c3468046bff6_darkside.exe

  • Size

    145KB

  • MD5

    d3d64f02fda9af093df2c3468046bff6

  • SHA1

    33ac70101c3688cb1074cf7fda84780b9c98786a

  • SHA256

    0f8a4d209ad5ac8e6450f1875c20e0b48e10b9046bd54cac2f957b2c5847ab96

  • SHA512

    b7b1405b086949662d126d62a3102661f37062a96b6b79b8868a3df045880d47c7eae1723c7ae16f404028c68575f611e90a9bb7034c76605627b5d2530540fb

  • SSDEEP

    3072:JqJogYkcSNm9V7DnKrKNzJgIJb587nlyAyVT:Jq2kc4m9tDnKrKNFj27nl

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (356) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-10_d3d64f02fda9af093df2c3468046bff6_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-10_d3d64f02fda9af093df2c3468046bff6_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\ProgramData\1803.tmp
      "C:\ProgramData\1803.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1803.tmp >> NUL
        3⤵
          PID:1908
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x148
      1⤵
        PID:2260

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-2660163958-4080398480-1122754539-1000\CCCCCCCCCCC
        Filesize

        129B

        MD5

        62f19085870afd0aba84f9401e5a36a4

        SHA1

        d3f48be44e69a65b550cd7fd67310c4c738c231c

        SHA256

        fad0ee0dffb8a10307fa1e749fe89e7d5b43598d385c8490a639551af934ee7d

        SHA512

        dc5675539282031d91efa7f92453e728a04fd0e511e4042a5671e84f0dbfc64028209a96a05d318499c667d771be2dfb067ab2ec084ef551a6fd907855d48d3c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        145KB

        MD5

        5e591e187489fbdbb303a5be69fa4270

        SHA1

        736c505e4b6eaef04d9cbc52770106cebcf88719

        SHA256

        c720ae45e8ddfa4d791e7b7f775829fa26f34df4dd744927da4b9e42d74e6cd0

        SHA512

        2a2943c095056665274abe75d781fe6a23913bbf53ee15c90f1021817f13463512ac175e3ebe43bacd518d2fe20dc90086addf3a4c21df88c44c5c86cf0b611e

        Download Submit

      • C:\kzCLVJRGC.README.txt
        Filesize

        316B

        MD5

        2ac741c065db09e3d3dd46af387f8a5b

        SHA1

        14b4eaef85ae94c64e6d6a6a7d72b8ed5d408de0

        SHA256

        d79423ec0a02af5c9ba6697cbb9e45fc09b5b6cd82541e30bffeeb1b4dc476dc

        SHA512

        f87c4c8e7a8b282df1efe936e42de2782d3b2059fa4491a077427f36f4ce0c0239eb8c8763e59d84efc0b7dd63a05c90bf7494addaeefb7f4193f561b34c695f

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-2660163958-4080398480-1122754539-1000\MMMMMMMMMMM
        Filesize

        129B

        MD5

        0aec92e7ee806f221b84dcd2e887c16d

        SHA1

        23df496e5a1f37d454084bf0d5f26bbd22dbbfed

        SHA256

        a511430fa5837a6565c377bc3ff4976e68e26f41e73e7279b9993645eed5c042

        SHA512

        bdcbd8bfb96605138cfe6d60473ac41e675a5b180024b8acf1957fa4006dec93446688281a0f2ae85c11463f2b03843085d338babf54ad5c8bfda766efe0dc75

        Download Submit

      • \ProgramData\1803.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/1620-0-0x0000000000350000-0x0000000000390000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1964-888-0x00000000022B0000-0x00000000022F0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1964-890-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1964-889-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1964-887-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1964-920-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1964-919-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download