Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10/08/2024, 02:35
General
-
Target
2024-08-10_ef531da468065fc649d072824c9a76e2_darkside.exe
-
Size
146KB
-
MD5
ef531da468065fc649d072824c9a76e2
-
SHA1
93c35e2e7f4915645479f6ae680683dcb3d9bc54
-
SHA256
d12c35c8825aad5b09855a89102236774ca847a7559132c4e9d92aaf69772815
-
SHA512
4c212df24e00fb7d93a5d26f27c3c0628cd7dbea67d7ee72844d1de5d6c5713860e423a01a8226da825882507f5982a06d01d8677e8bb26c66a43f131dac7894
-
SSDEEP
1536:IzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDjkxB81Hd8lQG9XtPmSQVwpdNIQ:XqJogYkcSNm9V7DjQPQGfjLpjIa1tT
Malware Config
Extracted
C:\xgU6NOijB.README.txt
https://t.me/bit_decryptor
Signatures
-
Renames multiple (363) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-10_ef531da468065fc649d072824c9a76e2_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-10_ef531da468065fc649d072824c9a76e2_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\3968.tmp"C:\ProgramData\3968.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3968.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD507589e43e5fd2f4e0a3fcace00cdf052
SHA1834f787d8218a233ee228aeea7bcaf7a41c6bd42
SHA2562b5aee54b88147d3b74437782ee262804e7d0ee122edcf7dabfac55219f4a9cf
SHA512b4828a5ea2cae0d6f4ae04e1f415ab064f5abc0c175522a58ebdeb9c65fafe1b682b8038b5a6db906e360c792aded0d53330254db70f268ed94039660bb3ab88
-
Filesize
146KB
MD51035cbb3061054392b64089301ef160f
SHA13c34085f27c8565ef290c0b78f27ad583af1aada
SHA2561b5a20af354af614fe44ede85644ff9e8ffb52f0a08fc56381fb21ed997ecc2b
SHA512d11b2873d07aa48c85f1d1833cc76cc4324806f8486284f5c6f13a326652b3716516f7f93c0cac953fe5d18c396fa95ac24d0e162e9732f796d34188327b8da1
-
Filesize
659B
MD5df4d96c8b221c68166583b1caae451e4
SHA10bafd479163c92f70bf5f8a169f3bbbadb3001e9
SHA256c60d5d35f45e57caea39963d6d8d4a4700ef80a5a70672ed7e8700f974e52ca3
SHA512af1bca3b4a94588cf19d8fac835c697848d4ff28c0760a1261b6ae983ead1dec35514977260dcf029eec60421ac7b88f47d7c6b4d55baf06272c09f05ca2d71b
-
Filesize
129B
MD51323aea02d1100933d4d2215635c3746
SHA1cfe94f67d2bb13afac7fd7243fdee76efaf61c63
SHA256f093242b6dfb4f9850a56f46cd6af40d572f416697d536b85e275956b4ae6ec0
SHA512b1bed05013f8d8e709b3dd4e55569c4c93f9dfe73b1121a786d6363ed857e877abbb324c52a3e97be33bca3374d92b42715ee8136026162e21aa7a41d3f0c073
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB