Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02-09-2024 08:35
Behavioral task
behavioral1
Sample
2024090220b0043ff680ffd554923069b7150b6adarkside.exe
Resource
win7-20240704-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024090220b0043ff680ffd554923069b7150b6adarkside.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
2024090220b0043ff680ffd554923069b7150b6adarkside.exe
-
Size
147KB
-
MD5
20b0043ff680ffd554923069b7150b6a
-
SHA1
5f5caf42e317e617994069453fb1c8d86fd2f1ee
-
SHA256
879e3a5051e3d56eaac8056e91dd8dcd11433198c0fc40866bf074c16f333ded
-
SHA512
a0757ad09a010d4ba7f3b5558e0e232c1faf3ca4e7b83d343150beee2b5341b767cbaaf4a17d9f3bb0e8f76b9a20f9fddf05c37ff3cdbfb28168dcdff160da44
-
SSDEEP
3072:x6glyuxE4GsUPnliByocWepFsvLGJJC0iohCI:x6gDBGpvEByocWe3svLMJhr
Malware Config
Signatures
-
Renames multiple (365) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2648 FC49.tmp -
Executes dropped EXE 1 IoCs
pid Process 2648 FC49.tmp -
Loads dropped DLL 1 IoCs
pid Process 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini 2024090220b0043ff680ffd554923069b7150b6adarkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini 2024090220b0043ff680ffd554923069b7150b6adarkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\N7prImOYL.bmp" 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\N7prImOYL.bmp" 2024090220b0043ff680ffd554923069b7150b6adarkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2648 FC49.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024090220b0043ff680ffd554923069b7150b6adarkside.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\N7prImOYL\DefaultIcon\ = "C:\\ProgramData\\N7prImOYL.ico" 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.N7prImOYL 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.N7prImOYL\ = "N7prImOYL" 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\N7prImOYL\DefaultIcon 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\N7prImOYL 2024090220b0043ff680ffd554923069b7150b6adarkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp 2648 FC49.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeDebugPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: 36 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeImpersonatePrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeIncBasePriorityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeIncreaseQuotaPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: 33 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeManageVolumePrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeProfSingleProcessPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeRestorePrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSystemProfilePrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeTakeOwnershipPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeShutdownPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeDebugPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeBackupPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe Token: SeSecurityPrivilege 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2648 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 32 PID 2212 wrote to memory of 2648 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 32 PID 2212 wrote to memory of 2648 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 32 PID 2212 wrote to memory of 2648 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 32 PID 2212 wrote to memory of 2648 2212 2024090220b0043ff680ffd554923069b7150b6adarkside.exe 32 PID 2648 wrote to memory of 2132 2648 FC49.tmp 33 PID 2648 wrote to memory of 2132 2648 FC49.tmp 33 PID 2648 wrote to memory of 2132 2648 FC49.tmp 33 PID 2648 wrote to memory of 2132 2648 FC49.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024090220b0043ff680ffd554923069b7150b6adarkside.exe"C:\Users\Admin\AppData\Local\Temp\2024090220b0043ff680ffd554923069b7150b6adarkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\ProgramData\FC49.tmp"C:\ProgramData\FC49.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FC49.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2132
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5e18b2f07781e903c8d886d5313eeb6ab
SHA120f2c5083e90107af69ce7a7d960b83bfda16d5f
SHA25682cccec2cba02632dbfca5cea67ae08d04b8ffa0702bb820c957724d50b64aa4
SHA512dece094438d396324ec3bee01931c5c00de98364e8174013e7bfb797f043fd77f8f04c0304df9c38dff871453d648fcb7d99c447864b7ceae76c41c4681ece99
-
Filesize
1KB
MD5f85801533c317ea9eaebe2a49a3a8eac
SHA1bb69bd97d68aaec2d3ce5c6d895322374dc3ead1
SHA25645dbe45beb75f80f6e34bd00a7bd35970ded5acbbe2b4465884c9853e2b87e5b
SHA512c049ecfb09322a3439a5f6e2b463d60f9910a8ecc2e73754460153109eb630c06018bebaaea00c7db262e9d5756cc45835e803efc4caab9c961401107a0dd4c4
-
Filesize
147KB
MD5f1cec7b9fde9e9760b12fcd79fac4111
SHA177709e8ea88f4022cdac89f747e165bcbc84dbff
SHA256d838db0540c8ef16a21ccdeb339b47f070e11fcc10412d15456bc099159a1726
SHA51278d3b807ffe6b7e2509fd98615c44abf93b65fb27545d03254670daf40b3875850df0c544df4276e135486e492ead06dc8aca6ef881da1a100804b41e85413e3
-
Filesize
129B
MD5f0717959901155b4f5d6871982cd327a
SHA1469bd6d54a9fc0f8ae7bc32679599f7c3de1d582
SHA25609cbf6bdc304e8f9b0811a5d778a6bf5aec482de4910800c34fd0a2f8a532246
SHA512ca816f4e9c521c732adf416183e9cd6bdee7e80a0f07f2b5e1238e1165c414e5c13e990284622411af4dbd315336e8937e69ccbed64590ecc5c65df13a1227f0
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf