Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-08-2024 04:23
General
-
Target
2024-08-24_24b9629f033f6a4d7c4801764db08534_darkside.exe
-
Size
153KB
-
MD5
24b9629f033f6a4d7c4801764db08534
-
SHA1
bfa6f43d1ff1c32fcf7f3e15a01b279424c6d98d
-
SHA256
2d62b9f80712715e9571d701e4ddf61e6904d5f493cbd98fd53647d37383528d
-
SHA512
a001b2b7e2a59919e2a7f8c67fe72299a20a0297e29995e327d9ffdb9fb347e113b9bfd0b9d6843c2abe4bda2c0a72eb0d218fdfd58c765d48bbb5100c0063c8
-
SSDEEP
3072:LqJogYkcSNm9V7D4kk7EcpCQyQd45xu44PT:Lq2kc4m9tDbGEcpCQd
Malware Config
Extracted
C:\v0GiGh9iq.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_24b9629f033f6a4d7c4801764db08534_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_24b9629f033f6a4d7c4801764db08534_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\183.tmp"C:\ProgramData\183.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\183.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3555F202-5434-42B2-9084-06D29C25583D}.xps" 1336894700061500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5b4c1178bb313a4e9f9c588bc65c51bd5
SHA1f67f2f711967a75dc7feb43ac74f908b0d8e9f06
SHA256e26e60399aace1eac009e5c0fc020ddb7e134e1b34e3d2370c0eecdbf0ded56d
SHA5126c5a520d1f77620aef7fe387f9f6062774b4fa059f8cd4fa68ada4fc02c66b4ed03039fdf54a5c2fe88f0085a98cbdc1acba2580006d89f85123791d3e1a74fc
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD5fad5ab9a76d504f328eb882c28e3034a
SHA1a9ab67e3ace5c8a9b9b77e77e93dad9d06e324df
SHA256cc87ab84ef6341a65df81cbaa78cfeae8f9696fe636dbf5bbaed7d3736bfc49e
SHA5122c8c57436dafcdaa9b43ada79da7b2f71d17d65349d6436933e87d1ed4190618efcb63ed2beb1d08e86469eff754bef7d42e7e1834158cd1537d498db6bc3ab3
-
Filesize
4KB
MD5f72694f93c3ca4cbb685b8fc41d3cce2
SHA15f885b35cd869851ae41e56b35b1e8c035694bfd
SHA256dfc16ad5aaf346f0127b5b557e785fc74c7ec6e795c869156b44bc82b37a0494
SHA5125ac4fc72faafc01636d9564d44d168b8f9298e4503ad99d2f98427c6bdf45cda291d7c70aa838c5fa915dad5bbccaafb036ce77d9fd6bff2633aba46ffecf77e
-
Filesize
4KB
MD55eaa6e30c6b9d9ec0703db83162e89ca
SHA15961ebadf964605aa46dc7aee9f505e805dd8731
SHA256abff483d037354184dd53315087279a45884eeb45c9f5748acf2701562b35402
SHA5123f4a5462d9a3c7c685c88cad1c33c02b1688bacf422d2ea3e7b9d02eb00f1a92993eb358fd26bbdff545032f0427876fa39b846ae9e13d7e39c384595d4d9528
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
129B
MD56e38769112149c87ba73b2ace2c00cb1
SHA18b967aa6c9746583cf18232fbe5441b14a6a2205
SHA256e3ef00ad458edf091fa1f3ad13ef089b63a6f599e4ceaae42773f777cc50fb9b
SHA51261d18bcc174912ee67b740579918e6afd6aff81c9eccf10de61cf1456b601257b80e267a1f5c923b52269812c9ef379747f21bcb5c152667fb264165476c0bf9
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB