Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 09:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-06_cd84ad68d30a2da1719757c9bb6239a4_cobalt-strike_darkside.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-06_cd84ad68d30a2da1719757c9bb6239a4_cobalt-strike_darkside.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-06_cd84ad68d30a2da1719757c9bb6239a4_cobalt-strike_darkside.exe
-
Size
319KB
-
MD5
cd84ad68d30a2da1719757c9bb6239a4
-
SHA1
04e18bf3eb191c66f1868ef24db9c4daf159dcf1
-
SHA256
0cf9bcf39b9f9bb6d58c2150384080bd2be671197463e637eaa41ac7849645aa
-
SHA512
7e1e43ea06e5c0b004cd702ae8197165dedc79c541c31140a96de73eefc44fd256a19fa8a798262a06ccbf982e25245982c99ae101f62ed62262f5ae288eb991
-
SSDEEP
6144:W/MY80hQ+K66d5klzcufj0zi1dNVsmfteFe1iqtPIAj/Wqz0wl:Ws62ScGVduFctP7V0
Malware Config
Extracted
C:\vkvRC2llu.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule behavioral2/files/0x00080000000234cc-2.dat family_lockbit -
Renames multiple (158) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation BE9D.tmp -
Executes dropped EXE 2 IoCs
pid Process 396 SOMETEMP.TMP 400 BE9D.tmp -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini SOMETEMP.TMP File opened for modification C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini SOMETEMP.TMP -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\vkvRC2llu.bmp" SOMETEMP.TMP Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\vkvRC2llu.bmp" SOMETEMP.TMP -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 400 BE9D.tmp 400 BE9D.tmp 400 BE9D.tmp 400 BE9D.tmp 400 BE9D.tmp 400 BE9D.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOMETEMP.TMP Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE9D.tmp -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop SOMETEMP.TMP Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\WallpaperStyle = "10" SOMETEMP.TMP -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vkvRC2llu SOMETEMP.TMP Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vkvRC2llu\ = "vkvRC2llu" SOMETEMP.TMP Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vkvRC2llu\DefaultIcon SOMETEMP.TMP Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vkvRC2llu SOMETEMP.TMP Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vkvRC2llu\DefaultIcon\ = "C:\\ProgramData\\vkvRC2llu.ico" SOMETEMP.TMP -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP 396 SOMETEMP.TMP -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeDebugPrivilege 396 SOMETEMP.TMP Token: 36 396 SOMETEMP.TMP Token: SeImpersonatePrivilege 396 SOMETEMP.TMP Token: SeIncBasePriorityPrivilege 396 SOMETEMP.TMP Token: SeIncreaseQuotaPrivilege 396 SOMETEMP.TMP Token: 33 396 SOMETEMP.TMP Token: SeManageVolumePrivilege 396 SOMETEMP.TMP Token: SeProfSingleProcessPrivilege 396 SOMETEMP.TMP Token: SeRestorePrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSystemProfilePrivilege 396 SOMETEMP.TMP Token: SeTakeOwnershipPrivilege 396 SOMETEMP.TMP Token: SeShutdownPrivilege 396 SOMETEMP.TMP Token: SeDebugPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeBackupPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP Token: SeSecurityPrivilege 396 SOMETEMP.TMP -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 408 wrote to memory of 396 408 2024-08-06_cd84ad68d30a2da1719757c9bb6239a4_cobalt-strike_darkside.exe 84 PID 408 wrote to memory of 396 408 2024-08-06_cd84ad68d30a2da1719757c9bb6239a4_cobalt-strike_darkside.exe 84 PID 408 wrote to memory of 396 408 2024-08-06_cd84ad68d30a2da1719757c9bb6239a4_cobalt-strike_darkside.exe 84 PID 396 wrote to memory of 400 396 SOMETEMP.TMP 90 PID 396 wrote to memory of 400 396 SOMETEMP.TMP 90 PID 396 wrote to memory of 400 396 SOMETEMP.TMP 90 PID 396 wrote to memory of 400 396 SOMETEMP.TMP 90 PID 400 wrote to memory of 4576 400 BE9D.tmp 94 PID 400 wrote to memory of 4576 400 BE9D.tmp 94 PID 400 wrote to memory of 4576 400 BE9D.tmp 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-06_cd84ad68d30a2da1719757c9bb6239a4_cobalt-strike_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_cd84ad68d30a2da1719757c9bb6239a4_cobalt-strike_darkside.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\SOMETEMP.TMP"C:\Users\Admin\AppData\Local\Temp\SOMETEMP.TMP"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396 -
C:\ProgramData\BE9D.tmp"C:\ProgramData\BE9D.tmp"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BE9D.tmp >> NUL4⤵
- System Location Discovery: System Language Discovery
PID:4576
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5fecb51840034a15515624b55701a9223
SHA115dc6b59305881e06f899ef0e25e06a47b81cfc9
SHA25608fd33bd651c8a9328143ac9dc108499ec1b8ef345658f06595ec69f0abf25c5
SHA5126297742a2317bf31c2ffd2af6fb82ab3f13552faedcc87eca41a3587de622f58e0c15ef240fe5972e548bccd66da98de79170fe63cc67e65476861371712213a
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
159KB
MD5b43b7f84cfe4c2edfca94484b8aebc11
SHA1da3a0d5f52800599f97491e0a89d2c427328c113
SHA256cd345ddcc051c7b67e0799d9425792462b0bbde44468c9e0b42c502753fcb4c8
SHA5124cf9458033b9950e338ef7703ba493597b377677e7ac644ee7afa1b158f4afa1ffd83447cc22985b9b1ddfbde31af9fab67bcfaa360c0de07d478aa344860494
-
Filesize
159KB
MD53020569d35f6eaccdecfe91ac9d45915
SHA1f206f13e6197d25858e025b9de6f97e487aaa228
SHA256c0ebdc749347292f852d0a7c692d8b811201cb27145f5f0f8cef54a9ad896a2a
SHA5127e5a6ec4180e30393bb9b39b47ee7beae08730c2f434910c53efad3fa21aa93832c2841e41bf26e385a388495433364ec7780f86f3a27148f3c6ebfaf10974ec
-
Filesize
10KB
MD5fa93a44f8ed76af2f254cb486e833e74
SHA1c8b513bcef90acfcc939af471baa241d3c4164c4
SHA256517e0943e3e2b3fcbe4afa929513d886038f12fe75daf9db96411bdd10ccc5bd
SHA51256680f94ba2b92c6791cb57c151deb170d764c27efc13e3a70b0fd3adb01e9986ed3f3c6391b39ebb721a8c84580e2297f808d671854c285780074d2b2612741
-
Filesize
129B
MD5e469a6952a8c6ec18fd30ba0073dce7f
SHA1063d7b7ea5218c34ac48dc90cfec4c3e2adaf4ed
SHA256615674096b019b0dbd5072c82f6ea001f1e8e30ec0b9aeafd39f9295c99e9622
SHA5129a168592160260bc8f3c1f1e2156b9f9933d9698ef8d57c46ebb497b53bdc42fc4ac149f0d269bf70d1e80f50767a01b3de50228ce35b1fb792a92b045f0c840