Analysis
-
max time kernel
138s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
27-07-2024 04:07
General
-
Target
2024-07-27_deb7ef58572b638de10c6c806a0960b5_darkside.exe
-
Size
153KB
-
MD5
deb7ef58572b638de10c6c806a0960b5
-
SHA1
72b3d55fac841336eafdd435227dd02f0081ca30
-
SHA256
622f0a32c590c461a03a3ce3fe5d5c81ad3f98aeae07b3a23c9659c3f0ae3f5a
-
SHA512
a425dd875ca1e036709d24459ecbbbe69c462c13d7dc34e4ba0ddd6d0b68bbefc20958f32e45c6dfc0479ae3019951b609bca9a7a2090412aba3098ab018ae48
-
SSDEEP
3072:z6glyuxE4GsUPnliByocWepr40H7zT2s4yqbrvbGC5C:z6gDBGpvEByocWe57fTYPvbH5C
Malware Config
Extracted
C:\6nqxYhlZe.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-27_deb7ef58572b638de10c6c806a0960b5_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-27_deb7ef58572b638de10c6c806a0960b5_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\9AA6.tmp"C:\ProgramData\9AA6.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9AA6.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{DA60C7B1-C754-4682-907E-BA9A966B6383}.xps" 1336652762156400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD51ace55b1a4c142f8a518b3250c0dc3e3
SHA11e3dc1c92f09c553b00cec28f15bb1be84c789e9
SHA2564d0bc0288c6a17195d3fd1cc16ce608db61ff87852c3ca8e7a4b50d94cc132b2
SHA512ef5df0f45ca3c2c9ebbd8b1909375c626e94a0d8298d4da9300c4b51c5c3c2d632e54a1318f38927bc1674207dd1a3d0550abd414ed1d0fd341848be43ac7169
-
Filesize
6KB
MD54c41dd21ec4f992fbc00cd833245c68c
SHA167db064c30d01ae4a6b4756f4f765c1802c3c9f9
SHA256b9b99f36cc0f4ca5a710efa61d99a4cd63a24742f9956382caf19d0e5fd4ab08
SHA5121f8d1c408dc2c06c6f27b32dd5d594dee5e181b9e9993d18cdce8504373b05dee91cb141e727a448ebd5e7a010d328a23855eb0997c9b121d97152d227159ea9
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD55bd8d1487005fb275fc42acd48b9cda2
SHA13b05b9dd93848b4e98685147ac07744283bcbaa1
SHA256f2ae27958cb9e5b4443c07f390962936e489dbbcf8a1fd3a6017a0b843baf590
SHA51206dc32c84d8f65f23b9cbea981a3d3d3c3fe920dac905735f57803bc37002e748f5f8c8b9bd1f5f9ef9333619239597d1e4a66e367ed79081d2350c1035f6ecd
-
Filesize
4KB
MD5eea2695e648a4b47e675e4a9b15e9bc3
SHA1afdc3f81cc5a646fe9a5a5f2a9f1761fe71b9574
SHA2560466072a25e3456431743e23ba344e2aba978c04648bd90753b0ce9a13127b52
SHA5120806d18046514480ea784688cdf3d75805b37b582cb71b95512883bb646e94e0ad6800f0dbea786bd3ab6ed796f3ac670da5fa5f6e361bb0c231c58922a3889e
-
Filesize
4KB
MD556f3282f57f4f3351da07dadc26c966d
SHA1100a2c5fddda2d15bcec09f40935bef4e2e2df0d
SHA25682ccbccb8baf52252feff807ad9916eb0532913c862443cb2079ad15caf79f6f
SHA5121f7b8ca202feee54a2c5c42f69b5f2812285e10046192d7661a45b343809e044844f67610ce6708923b1509c4be21bd9e69ae4636fec2d78c32aaabae69d4701
-
Filesize
129B
MD56f4e00af8227acd4ef86fd7769f78066
SHA1b9865aad217948721fde2c168eb4d7612b0fa78d
SHA256fd8c8ad9f14f9a0596043f364eb56adc9dbf16dfa16cd263a49282afa8d9ffdc
SHA51281524934d51edf8fc729e669af1a1154b263f00385be3424068e01c138508c90cb7810e66b184044ee6e287c3db0827572071fdf51fee259d6c5aa355267b008
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB