Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01-09-2024 17:57
Behavioral task
behavioral1
Sample
20240901a465ff20e72f5331d0a6849099565c05darkside.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
20240901a465ff20e72f5331d0a6849099565c05darkside.exe
Resource
win10v2004-20240802-en
General
-
Target
20240901a465ff20e72f5331d0a6849099565c05darkside.exe
-
Size
153KB
-
MD5
a465ff20e72f5331d0a6849099565c05
-
SHA1
c3053fead46c7b410f87cec1b77391ce325f521d
-
SHA256
6cc7335b85cba225557ba602fea5e31a61a38ba82642e74072e29d87107abbdc
-
SHA512
2b8da0299a6356e8ec3e8b476dd96548ceaf9702877c2803b2fb129f101277beac3f5a17113a14f228690d629aeba83c7c21128ea707c8d5265937e68ea47dc6
-
SSDEEP
3072:nqJogYkcSNm9V7De6lYk4uvPQiPQivHvMkT:nq2kc4m9tDe6imHTPv
Malware Config
Extracted
C:\qME3ty4ED.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes itself 1 IoCs
pid Process 900 DC25.tmp -
Executes dropped EXE 1 IoCs
pid Process 900 DC25.tmp -
Loads dropped DLL 1 IoCs
pid Process 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini 20240901a465ff20e72f5331d0a6849099565c05darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini 20240901a465ff20e72f5331d0a6849099565c05darkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\qME3ty4ED.bmp" 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\qME3ty4ED.bmp" 20240901a465ff20e72f5331d0a6849099565c05darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 900 DC25.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\WallpaperStyle = "10" 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\International 20240901a465ff20e72f5331d0a6849099565c05darkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qME3ty4ED\DefaultIcon 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qME3ty4ED 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qME3ty4ED\DefaultIcon\ = "C:\\ProgramData\\qME3ty4ED.ico" 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.qME3ty4ED 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qME3ty4ED\ = "qME3ty4ED" 20240901a465ff20e72f5331d0a6849099565c05darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp 900 DC25.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeDebugPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: 36 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeImpersonatePrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeIncBasePriorityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeIncreaseQuotaPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: 33 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeManageVolumePrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeProfSingleProcessPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeRestorePrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSystemProfilePrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeTakeOwnershipPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeShutdownPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeDebugPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeBackupPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe Token: SeSecurityPrivilege 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1644 wrote to memory of 900 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 34 PID 1644 wrote to memory of 900 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 34 PID 1644 wrote to memory of 900 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 34 PID 1644 wrote to memory of 900 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 34 PID 1644 wrote to memory of 900 1644 20240901a465ff20e72f5331d0a6849099565c05darkside.exe 34 PID 900 wrote to memory of 804 900 DC25.tmp 35 PID 900 wrote to memory of 804 900 DC25.tmp 35 PID 900 wrote to memory of 804 900 DC25.tmp 35 PID 900 wrote to memory of 804 900 DC25.tmp 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240901a465ff20e72f5331d0a6849099565c05darkside.exe"C:\Users\Admin\AppData\Local\Temp\20240901a465ff20e72f5331d0a6849099565c05darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\ProgramData\DC25.tmp"C:\ProgramData\DC25.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DC25.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:804
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5ffaf5b2e73de4d375cf85c1b0e1643ae
SHA17af90ee4facaa8116ad6582cf480336fec8312a2
SHA256a5425237ab6ea853976ac6c5248b7492e037f77485ddc9f688c7897a8e9f4dcc
SHA512d7af7885abf1ba7badd52376e1b25379877b4df9f1087ef574723f9e6dc05b95170ca9ea9382f0b12ab1591bb6b752561be472a987300446befdcb8109e3f90c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
153KB
MD55572955e8b50d8674bbb86e5274d9c13
SHA1a316112f34083e45f35fda05b1e3982d716a11f9
SHA2563b0d2d44f825ecbd46ea47bd85815269b5f7657318bda33c198b88adc7e86212
SHA51244830055a965d744fdeb81c57f58d27c0257446ec199b1d5e5a2e1f5955122305e80680ccf421c77e29d5adfa9f959b86d574072f010aed468ce991ddf7f5470
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
6KB
MD5f9366230690f4341bc9c9d958d042cc0
SHA19ae05629d0cee0b7e0d1a87e0ec812575c7cfe68
SHA25653e1aff3d9bdee7c6c0068f5553d88fca8f1399007fb47372717397d06d8f433
SHA51242af70bc2e1109633e259fc8a65650b1d8ff4d41456abcb39b4aba80c68d711192f2a21da3c9889fc71e7624692f0ddd3216c570ad8b67c48f09f180f11f8931
-
Filesize
129B
MD5e863ca9a627716786cff2c74976c4a0b
SHA11b9b8f022c5531f1899f724861b120e0148f8629
SHA25606ba502a70d9bffab429fe685fbd6f64e0fc3a7d7503de46f3f739434c4b92d2
SHA51270871e46302c26577c318131d594636841c3676814f95fa92f0ff9fad2c4530db764f1e6650184f96dc154dc0f8498f12002056ca8e3348051e732173d90092c
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf