Analysis
-
max time kernel
148s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-08-2024 01:40
General
-
Target
2024-08-10_6cdd65b2528aca3895ead2e54d61f106_darkside.exe
-
Size
153KB
-
MD5
6cdd65b2528aca3895ead2e54d61f106
-
SHA1
0bbbc99c538359e057527fccf361daf58d5bc025
-
SHA256
917b33e593e91740ff2b3d70014cf6eb97a350be996e99fe85b7c52e9f88bb27
-
SHA512
2bd6b2018a5ade94a407141b0264e4fe0efffc87e3e1a9e19c958e3c04ff861942e2aee86b063d30e14e45437e393e60d90aa52a3be76a71b4d3bfbcae42232e
-
SSDEEP
1536:zzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDRZwXmANmsaqsJYzbMBMZeUyz:sqJogYkcSNm9V7DRZw2AIs2e3MOYT
Malware Config
Extracted
C:\7zaVhxrLu.README.txt
5989<redacted>[email protected]
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.garlic
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.garlic
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.garlic
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.garlic
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.garlic
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.garlic
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.garlic
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.garlic
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.garlic
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.garlic.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.garlic.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.garlic.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.garlic.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.garlic.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.garlic.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.garlic.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.garlic.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.garlic.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Renames multiple (611) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-10_6cdd65b2528aca3895ead2e54d61f106_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-10_6cdd65b2528aca3895ead2e54d61f106_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\ACAC.tmp"C:\ProgramData\ACAC.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\ACAC.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{12BE6D4A-94EA-4C7E-8EA6-62A92E64887C}.xps" 1336772764822600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5fa6738ac64c3244dbb9e0db70ebab065
SHA16235f2b5b1071cbbc38696c7db4d77ea6fdacd38
SHA25691e92d41e6754e019ad0c86f0f2e4b4253730703658d1a919d7767f4d0466a9f
SHA512bbeaee59768ce34f472a7f8d15213293e8e8bc65dcf1c7c87c7c16703c7f5c36cd9c628749fc0eed05bdb68ab479880129f05ce498b048de84c5cd4ece6dc11b
-
Filesize
6KB
MD5d917f69f1414b91b4c8c3744c6c317f7
SHA17fee1134323f88fabb12ca20411a22072cb75455
SHA256b7d653f5878b69363243ad18d5224b4f77bd28c2147f6dd18af137a4f9cc5b29
SHA51294e0b49aa68761d1dbb424a98a6019d9af0e71a07f7cc9c80665dce499357bc0055d05d11b468c1738f101e8b37707aae122d64529d01e2557f06ae49aece503
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD51a45fc2c46cd24e58762eebf3399e87f
SHA108204e94eec1a20a8b9cde2718cc89fbc1fc2132
SHA256ef8a402c655779a925b2b12b70a191e7671eced1ff2a71fd3e0bef191de476e3
SHA512ae21e6999ef2c7cf11c81eacab8cd4dc4aaf49b481ebc1e9ba9aadd4b1db6bae969be4582b4bc509d8965892bd0964b09bc29ca5963c6d0d81e38e2595502227
-
Filesize
4KB
MD5c1bcde4320f05ede24c13f8ed91e0053
SHA18926ea5e1be3590fbb5ab3b0dd6786098a0ae3a9
SHA2565cb43223d9ac4d6894fd0c411c341757fe0b4c6cc8b606bf9f419d944145ad8e
SHA51285f1c56f24da469b99cef1c3811132a762527367833e9a0d3b7377f488618b53d661f21ac2260ed38cc2437b6b880c42e10f3ae0f7e361711480fd182d7c49b6
-
Filesize
129B
MD50b3c536d4c46962151688f7e22d56d1c
SHA1ede04bb51c0dc68f45cc63017c3d8dec9a32c56e
SHA256d473dbdac885b758fa3cac089172bd4eec386a7e829dc1be0060f24f69b2db94
SHA512690573024f02949c2d7ca958ae9d0be9e55902e2447bff70c6b524ced778b1bddffaf73138f126db4b2f54b40948948e46e8b3324ac208b542fffec5fd06f4f0
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB