Overview

overview

10

Static

static

10

2024-08-11...de.exe

windows7-x64

9

2024-08-11...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    147s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-08-2024 11:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-11_7aeb2d5c828d7c8c6525ce7710c81d7f_darkside.exe

  • Size

    146KB

  • MD5

    7aeb2d5c828d7c8c6525ce7710c81d7f

  • SHA1

    d72bfaf7d9700beb02169c61373d1a11e3923138

  • SHA256

    cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48

  • SHA512

    2081495f5e3b7614baa88bd61028d77bfca3e8dc980ec16506027d42131ae2364db074ce7e5c4842d54741909775611dd4664ec70446f83b770bc7627785127b

  • SSDEEP

    1536:ezICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDhhsfITrOOZUrDV17OK7jVUby/Y:FqJogYkcSNm9V7DiIdZc51r7jS1bT

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (627) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-11_7aeb2d5c828d7c8c6525ce7710c81d7f_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-11_7aeb2d5c828d7c8c6525ce7710c81d7f_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:1428
    • C:\ProgramData\EB99.tmp
      "C:\ProgramData\EB99.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\EB99.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:952
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:3796
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{A4CC8CCB-B1AF-4A02-B7B2-7F71E907055A}.xps" 133678498672010000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:3612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini
      Filesize

      129B

      MD5

      f990c15a706269bee415dbc2a05df7d3

      SHA1

      0df386d926d28fb17c79be898b4a7abcdef4e225

      SHA256

      31fc9ec984eeef78ba2d9adcb56ed2bc2179820ba9d0f05c022952b38e295060

      SHA512

      999b66aa5ec5f860d4776f38a9b460a411332fde3a22f2a5a73a9ddae201532eb836b7898d25e02e6b0409e036c92483e01b281f424cfc343f44eea0fcba24cf

      Download Submit

    • C:\ProgramData\EB99.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      146KB

      MD5

      afff6f93da85fcb3dc2e8fa6007cca7e

      SHA1

      b37c2236a3fd524a4b3426fc00f277a960dac9df

      SHA256

      9924cdeb1d3e0e4b4e7b6082bf313f9e6742844dcbfc845cfdb8884cb773f448

      SHA512

      05af9f44c632c478417596ea3ef71d781c442bfae8794df7cf2b650d6291fea04b2af75221ffd3f60dcd7604a03763e911710acaa2b2b69e2a70bb4515ced077

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      3f16387cc3f800ca1d430948ccf4c2ff

      SHA1

      9015b974bed0da8e5143841b698483e3c5fae3aa

      SHA256

      8e4372584958cdeb4d0832113507ac492a110c5ecd4c9aecb5be46ed6cfbc811

      SHA512

      b976672b67d7a6e54fe8f0d1d5217fc0f3eea30cb43435da0b4d4c2360fee306f66d26d97d6a372e23b7399d3f7adb9cd747aa52fb4503a0773b686d432b6b2f

      Download Submit

    • C:\Users\Admin\u67bPvnd7.README.txt
      Filesize

      596B

      MD5

      5427cd674e8f86faaa49f0e48a7d3fa5

      SHA1

      70f80c87a506eda9646345887e63fa11a054b03c

      SHA256

      d671f9a2b73aab36554a437560291b23aa012b2d7527609123778900bcccd68f

      SHA512

      b75fbbdc3769f2ac37a9d74755d4d1e5c47e7804319637e6fb7b0fb209c5b0aaf3a8c732fc4e6e7f69a92f34cca2b7980d3923b70a07ec3ee50cfe9813e4c65e

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-945322488-2060912225-3527527000-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      6371c624be142b908b94f9b6f25e8eee

      SHA1

      bf5f25a1f0a00a2d5edc1b7b8d09f396325ddbf9

      SHA256

      f983e13b6f94d087b78ad970d41c9b7e70d6f0d168cc9c6dd61657172fb207f2

      SHA512

      c3e7c14b9b40976a7c7ae8bb4b6126bac4fb8dcee71fefa1b88f8f94b24f73b4371d9cb3c3f836bec0866e39459b2b8df11e4b9bb09e322b18f762c4cb673936

      Download Submit

    • memory/1476-2-0x00000000029E0000-0x00000000029F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1476-1-0x00000000029E0000-0x00000000029F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1476-0-0x00000000029E0000-0x00000000029F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3612-2998-0x00007FFD45AF0000-0x00007FFD45B00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3612-3006-0x00007FFD45AF0000-0x00007FFD45B00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3612-3009-0x00007FFD45AF0000-0x00007FFD45B00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3612-3005-0x00007FFD45AF0000-0x00007FFD45B00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3612-3018-0x00007FFD43440000-0x00007FFD43450000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3612-3019-0x00007FFD43440000-0x00007FFD43450000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3612-3008-0x00007FFD45AF0000-0x00007FFD45B00000-memory.dmp

      Filesize

      64KB

      Download