Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-08-2024 08:34
General
-
Target
2024-08-18_41f4b24e3ec888ac4010a16f75104e48_darkside.exe
-
Size
153KB
-
MD5
41f4b24e3ec888ac4010a16f75104e48
-
SHA1
120fafa9fed71f7ae249f8b36b5162dc991fa290
-
SHA256
2a441cb03145ccb1a86f7a6c4ee5dd521e0b03d16476b0701c17f7b151bbc31e
-
SHA512
b73fe51c06b5e17075af3d2786b20137a9c36ac3c835cbadfa1129bd99b93527cca1601c156cdd8172696d368f60b74192dedbec5e218b801593841089a118ff
-
SSDEEP
1536:2zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDXpLBcQXvZOcCHtHFnj1Mmyjm8P:NqJogYkcSNm9V7DMmvZ0NHFnj1KKgT
Malware Config
Extracted
C:\4hV6JPAIh.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-18_41f4b24e3ec888ac4010a16f75104e48_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-18_41f4b24e3ec888ac4010a16f75104e48_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\E149.tmp"C:\ProgramData\E149.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E149.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{559900AD-F802-45EE-A0EC-688962A6E0AB}.xps" 1336844366970400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5706df95202fd1374ea0402bdff04bac8
SHA11a4b12e0bc7e051a2ad9432a1d4d04f35b830a4c
SHA256a1cae18d22efe3c17b39d37c22ac65d8ea57b22c0e41bb1fe44bda684444b496
SHA512198780ce633955896f45547be945f57d90478d5fab0367d0036c275057b843dc0c2a04190e1a47f7891c8d64785d934997cc62bdb3a13fccfcebea4d1cdf983c
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD561f5460ab0e2bdd7486eeeea9f9b5121
SHA11b6eda41d6a0aa2bac52114ccbddea55141a6c54
SHA25620609c6decfc764cd54697241118b74768114a2a54f873057f9065e463575a11
SHA51258fef70adf4bd3108f2ab67a54894ab8a66848cdfa6b051860b6bd9b47f5cfef80facb54ece81c221f75043a4671d4a33654fcf283f7bb8a7a207443fd560526
-
Filesize
4KB
MD5ab38562fa4da25a28dc6fe4e25c3cd7e
SHA121546fb408d919f25bac4638b6ec2128e3a14ca8
SHA256f0b632d60f4f0a87ea9ae5633ce082bf7479f32f1cb55c691f9e5f8780a30e84
SHA512d45efb9001287bf533399b60316bc9033549769f4504b139b0c1c5fd2a54873ca2a3d83c16ff66af8d33f683cca4c5429b007761c2a8411bce55ea56ccfdcecd
-
Filesize
4KB
MD59e500316df7b1d654e29cddb0e954461
SHA18701f0d26f976cdcc44f35e5aae943ec44272dea
SHA2561d44f5028753e69aee76402125fe68870cce61e723f5ccef086aaf45070455d4
SHA512e42d746e31a0de26a964a5716d13f9ed6ed87890f08075d12cc83aff25d0ba2eeaa4a9c86631ca859dc04421674b4a57a14884ece82e9a1c41c490aedac03a64
-
Filesize
129B
MD558c91451939b7673b024017152616c9c
SHA13514a4d3e73fcdfd40691ce3aaf64267c9ab9a0d
SHA25693bf7ceb2f54ce5ae52179968abde564d20795b94c5d42a78e0712665512a52c
SHA512f7d637e194e3dd021366de1164e8b337c0b231b04db023e3fed7386d3c9481e14c7b2cebfe90757ca0064317bed83cad1b5f7b7e6dc3760490bcc135a72dd634
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB