Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-08-2024 09:56
General
-
Target
2024-08-15_f7f9b71d2699fd47417d839079fbd1d6_darkside.exe
-
Size
153KB
-
MD5
f7f9b71d2699fd47417d839079fbd1d6
-
SHA1
8a7ab79d9a2603a244563c74588c29154bae36bd
-
SHA256
f58533930a82b5c442bcbef9e013af8d8041ed2b91094ccf4d18e5fae6e0b126
-
SHA512
07ef8bdf026f49e42bef8cc3a1b7474d33a10ca26ef6785d413c50440a4b3d8499c6b401b53c7a1e5e517875e0d7e8029a75d47f696d52007febd08c3f2ce2a8
-
SSDEEP
1536:ozICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDHo3EDAYze3U2l0NmpixUbcLGpT:3qJogYkcSNm9V7DH6EDAAe3U2lLkwT
Malware Config
Extracted
C:\Kx6HE7BGb.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (605) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-15_f7f9b71d2699fd47417d839079fbd1d6_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-15_f7f9b71d2699fd47417d839079fbd1d6_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\F2CD.tmp"C:\ProgramData\F2CD.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F2CD.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{54580303-CF99-41BF-AC4C-B919A5F220EF}.xps" 1336818942863700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD542b2c5e3b7847c96f502952121d2e5c5
SHA17b591b63312487c97865f385e8852821c9221ae3
SHA25624d5439654d03c1bd0c5721ce8b75c77905d19f1b8bcdfef67ed335e493f0680
SHA512b6dfa1ce0c8b1333eb98e3fdcda6e1334ca0b7f833904792dbf691d4e2d1c96efc65f8df2236d458471a50c744b547475da46293e660ea81658ccd287389744c
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD55cc5a46c310f0af960a3fee4055707de
SHA1dcdd14f119f490a954b595b83e5b0b2f8cc3c248
SHA25648508a802676c4d214fe900770a00f56d4bcc291f5058ecf7edaa4d6541bae52
SHA51218dfcc66b834e2869bf8e1e7a597836b44bcbb91ec6543a2543a5df83081c834721b42f5555460c32c78e2df74505cd54e6da21a89d8802e33dc64ec453a31a6
-
Filesize
4KB
MD5a8ac959871881577cce8260a9b834591
SHA1d2b7924dbcb29dbeeb14ee386430641e153ff748
SHA256162b4e66697fc6716087715f03e939214f838945edd72a7cd46d9e786763cfb1
SHA512bf6ddd8a1d66aaa946bb27bb36478cbcedb4907ccf8ba6e8aa50005a6e10fea2a36fc4011c7329bca7a2ce2f871ba640577ffe7e1b19dcd189f8a81009bc4810
-
Filesize
4KB
MD5a388cfc73a4381d0b905f1e72c9210a1
SHA12b1b5d1b6bcfb08ecfc835174c912f4a11fdb21a
SHA2565577de3faf646b1dfd3c697146934ad13965b10cdd910257909f1501ffa907a5
SHA51261d4ef34a0da9359c8e12278495ff9b0137b912c7d9c97b089e3345694fee2623506a954d5ec3d37b9e574c8c28ba8c0e73dcab42d2bb87aca07db631f25ff74
-
Filesize
129B
MD517b7a41be039e8b2abd3f76bc2d981f9
SHA13069957d9d539504291edb6b48728beb46d964f9
SHA256628ae42be95c827296a5b8d0dd0a736afd390cb52e8f849acb9e6ce2ec196145
SHA51294ae824b98f58f2d84bb9bab9f0d71234ce13156b92f18b3bbcdec96eb388d86e7c78216d0496df6423b24995e3dc8bcab4c7ed92ace4d01bdca6dca963a6541
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB