Overview

overview

10

Static

static

10

2024-08-24...de.exe

windows7-x64

9

2024-08-24...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    141s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 07:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-24_819b75101c9275a3bb120a774b8fb7bd_darkside.exe

  • Size

    145KB

  • MD5

    819b75101c9275a3bb120a774b8fb7bd

  • SHA1

    56c077ced059f088ffe01dee50420f10c89b7441

  • SHA256

    67ac70fd9cadf9bf5c827313d444cd3b3d28dfc8f86a7150bd990ab87b634418

  • SHA512

    61c5025f6527b38aa7062ea2bb8cb6d46d4fadeb0e8cc19766fdf9f8161f5e35818123e10567803f468120cbc2b0a685d8113c9b357aa9798bd70b0e39b8a388

  • SSDEEP

    3072:cqJogYkcSNm9V7DuUdq8Xv9SYYZeJ1hm3wE2fyT:cq2kc4m9tDJvBYi8

Score
9/10
discoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (648) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-24_819b75101c9275a3bb120a774b8fb7bd_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-24_819b75101c9275a3bb120a774b8fb7bd_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    50394e49ea27e6a8a2e76fa3d26814da

    SHA1

    6ee33a13f4a354a66c4c4dd22e5d5cb1bbd19753

    SHA256

    103802482fac13ae225229dbc2298ff4de69f2c7166e50499747e93a7d63cc96

    SHA512

    38b167d9c87a254e0fb19ee69bea931d1de915a9367401221ea9c920ab1796019a04a1da2fe25ff6dde2721b04373b0f61d19d8a2f4ea98690d8d213e5942f00

    Download Submit

  • C:\NrATtMuch.README.txt
    Filesize

    321B

    MD5

    493b7b448f9492721eb5b7e1a1d361eb

    SHA1

    179b0423476665509568f70c67d33d4c0b06875f

    SHA256

    21570ec2a6a278d8214f72b7b820c47e52b673c43a57ea82e418f20a3f183cae

    SHA512

    0590f14bc5b228948756840c31dffed690edf8ab5a0d95169b028757302547a4d70328c43311d977b7808b38c86c23be54c2314eeeb11eebcc2a343a1e018303

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    a4bfda7ff2d1b61ab9da33e5c9155512

    SHA1

    42dcea286c7f1fc39a931de03392a5f4ec623d2b

    SHA256

    664f024e6a245ed0cd3945e2902bab17291c2b7f1189f9a186e9ec715a070c21

    SHA512

    19e99c8cb618f851c67a502173ec6ffc4e83e2d8519c828f508af9af62bf1f2213a078a91c5609bee530f4e37ae5b826bb2815e5dd826a103d5998faa0b72336

    Download Submit

  • memory/2888-1-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2888-0-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2888-2-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

    Filesize

    64KB

    Download