Analysis
-
max time kernel
143s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/08/2024, 00:45
General
-
Target
2024-08-21_dd68c56990a476d5b4ddf87d2c0788b3_darkside.exe
-
Size
156KB
-
MD5
dd68c56990a476d5b4ddf87d2c0788b3
-
SHA1
2197e7c5ddc77e6a0d3e84f102bfc6beed9668d4
-
SHA256
6ce1cbad9639b8655e5370ba348e83793e825c2282a06af81b4fb6ad608b320a
-
SHA512
f21dbd63b28f5ab225b94ceb7f70f5ce48e2b3c2b1505b8934a7c5bee7a715f737fd50e1104c1a9fd0fe2be7a59469300ede53cd565eef8419f951264724e007
-
SSDEEP
3072:LDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368OckDEzlGPNsWzHW:l5d/zugZqll3LkgZSCWz
Malware Config
Extracted
C:\Users\OFdrwldJh.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Signatures
-
Renames multiple (123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_dd68c56990a476d5b4ddf87d2c0788b3_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_dd68c56990a476d5b4ddf87d2c0788b3_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\C459.tmp"C:\ProgramData\C459.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C459.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD568ce92e2e7faccbe6afdc433a6be940c
SHA1a534b0ba9b140b5df8215b0c2bedfe8384fe2afe
SHA2567628fdb9fa10533a657267c1146d3aad88cff52b678218d85ba3cd89ed428465
SHA5129e902a5e48992e496addce004482b585ca6ab2530d84e66f4c5c912cee303d029a60ee4263b57e228301b28fd875301a26b9e48ace488f84b05cd3498d7043a1
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
156KB
MD588691438ff24679171b643313d8c6c50
SHA1398c39922f07d1f2ea8413c32ea353dafefce0e1
SHA256e0326964c95f6d31c785ecec18e7750f4ac16e84cfa4fc2fec8c41a643e3e82c
SHA512a1d67d9f46ee81e26c169bc2f9545c9723487d261714831ae6423ff577e2260837cf65ea84faea51de3e88b6e45372a0ab40dabf029c6e7bb34d5631ad432f63
-
Filesize
3KB
MD5b73ff883c485819e68e4270647293cd7
SHA12239e3b84646b1ce664e9299588b5b2d3e4f97f1
SHA2569a1c3fc2eabbd298aef2c7941ee03bd1cbbb20661b2d4b466e5bcd162b97f280
SHA512e40f755d74c9deba0ccb783191b120d3ac384707282abaceca61c293bfc6d17fbc51f7f94c8e97fde83113f6898fe553d9aaa9a499dddc89ae91b66029fe9423
-
Filesize
129B
MD5a1cdfe6fb914d874d42de49c901cc517
SHA1a755453e0cb3432b0ab0ef6a65c6c7b744e0cd32
SHA2562aceb25281808eefd48f63d133923eadfd290eea079ed9998727a5bddd887db5
SHA512b0d4108eb3eac6244e06a0f97b712216a8155bbe5d9b49910ae69850ea7ab89b7d8a311b594a42be7e807decbbf600934b6d9979d115063793ce5748b2c932e6
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB