Overview

overview

10

Static

static

10

2024-09-10...de.exe

windows7-x64

10

2024-09-10...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10-09-2024 10:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-10_04e651e75deb8edc024b8295532f5d3f_darkside.exe

  • Size

    146KB

  • MD5

    04e651e75deb8edc024b8295532f5d3f

  • SHA1

    d8660e404e98db706ae3b74fbb04d08a2ac7130b

  • SHA256

    3934455289f9b1a4d37c785c89e8c177c58e20406e6f1a825b3b2ae19d665da2

  • SHA512

    b1b46d0fb381ecb15aff708c0751cff95992b15d897602cc119590f6c1ce13b2e88b8c862dfc1e8bdd8c7b96a5eb3bb0eafb2f3b0a2e8485dd2257888cb19b6f

  • SSDEEP

    3072:mqJogYkcSNm9V7Db/aSG5HF5v5pANOhKT:mq2kc4m9tDvQHF5Xt

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\HdbtqCuyh.README.txt

Ransom Note
[Your Files Have Been Encrypted] Hello, Your files have been encrypted with strong encryption algorithms. To regain access to your data, you need to follow the instructions below: Do Not Attempt to Recover Your Files: Any attempt to recover your files using third-party tools will result in permanent data loss. Pay the Ransom: You must pay a ransom of 1 Bitcoin to receive the decryption key. Payment must be made within 72 hours to avoid data loss. Contact Us on Telegram: To get the payment details and further instructions, contact us via Telegram at @BIBIL_0DAY. Decryption Key: After payment is confirmed, we will send you the decryption key and instructions on how to unlock your files. Warning: If you do not contact us or pay within the given timeframe, your data will be permanently lost. Do not attempt to contact us via any other means. We will not respond. Your encrypted files are your responsibility. Telegram Username: @BIBIL_0DAY

Signatures

  • Renames multiple (326) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-10_04e651e75deb8edc024b8295532f5d3f_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-10_04e651e75deb8edc024b8295532f5d3f_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\ProgramData\9702.tmp
      "C:\ProgramData\9702.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9702.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2352
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x148
    1⤵
      PID:1352

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini
      Filesize

      129B

      MD5

      f9eb332338e2b65387a4f491c5654aac

      SHA1

      c0a7006717652b265cbf4f1c99e12e003629ab11

      SHA256

      346961efa2ce7351f4ba01d2ea97a1cf537e40a3cdc5a9af980d6f9ab0a2b3f9

      SHA512

      e0cc0fdf89ebf7efdfe49b569fefeeb7fe5d37afd1142f5ed582b473cd75344399e137927a022406607d6aacdc5dd3e81838400030baa6af460e842a60bff29b

      Download Submit

    • C:\HdbtqCuyh.README.txt
      Filesize

      980B

      MD5

      751940dccf55d21d7dcb7b8e614154d9

      SHA1

      5ef19237b4aaede4e95992356b2ec1481c1d8253

      SHA256

      875eafed5ef1785ec9cbd071d039aea59a1cfee0b62a0105d9b57118860ceac5

      SHA512

      afcfb8806c17fcdf1e1160a92719a79617ce4c4f6339c412bfaa3cfade6d290e2ecc936bec9f30b631ecef304744caa2e2a1a3f89e4e4e0f705fe6882e3236ce

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      146KB

      MD5

      e78d39feb487d37ebad0f5cf9f460de5

      SHA1

      6b2b5434b38b9b3e24323216786f53ef55031e2d

      SHA256

      ea97a7c84cea61cdb402a9f9b3eabe45caff02da450f776f8c94d90e7ad0e9b3

      SHA512

      a392903882a9a0c301c0646e589d216cbdbe87f17a3cb05bb70f9fb64cdc9050c8a84f6ad59b6be34136d3536817a64d8a8707561d8f02b6aea49f744ec4a978

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\FFFFFFFFFFF
      Filesize

      129B

      MD5

      c448d00e85c3e3413e9245ff1bd3b938

      SHA1

      37d45503b8af2594dde8804351690d5ecbb6f155

      SHA256

      380aac8a1918cf5a31ffa9fa8eeb940aefc9c88813015cb0ee6b65c7f8babecf

      SHA512

      2aced2b35c90680a9057b151e950f6ec7111dead3fae2838fc1f760dc623a078a188323f4ad1ac92842f00cd028f2af804e6172263efc1d4d7c3b7dd8525361a

      Download Submit

    • \ProgramData\9702.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/1996-860-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1996-859-0x0000000002200000-0x0000000002240000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1996-858-0x0000000002200000-0x0000000002240000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1996-857-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1996-861-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1996-891-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1996-890-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2596-0-0x00000000002A0000-0x00000000002E0000-memory.dmp

      Filesize

      256KB

      Download