Overview

overview

10

Static

static

10

2024-09-16...de.exe

windows7-x64

10

2024-09-16...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 15:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-16_b71bd8482d6e872bd867966a1e572ac9_darkside.exe

  • Size

    146KB

  • MD5

    b71bd8482d6e872bd867966a1e572ac9

  • SHA1

    926d496eed4f6735999dcac03b9295222ea45dc1

  • SHA256

    f156e0cc550938d59d92fcf7768d5070360d46c80555ed4f972d2af0f4233fdb

  • SHA512

    4392f36b65fe82ce102a0faf55f2fdce4cd8463cf42eab2ca68bcbe3578de4804d5ec475ed2294fc8e7bef9e319af18ee2656dea4b499ff43476f2a8f35d85b6

  • SSDEEP

    3072:x6glyuxE4GsUPnliByocWepqzW0lfCoCufrJikFt1YY:x6gDBGpvEByocWeczXlqIldvYY

Score
10/10
lockbitdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\qcH9iqGVb.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us with your personal DECRYPTION ID: 192C4C26CEA15FFC4BB9144C53DA46B7 >>>> To contact us: 1. Download Getsesion https://getsession.org/download 2. Add friend my id: 056f75f9f2a86187593f214d3747e0dd62928ce31e33e7dcb70ca79ab7141b2207 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

https://getsession.org/download

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Renames multiple (603) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-16_b71bd8482d6e872bd867966a1e572ac9_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-16_b71bd8482d6e872bd867966a1e572ac9_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:2112
    • C:\ProgramData\B816.tmp
      "C:\ProgramData\B816.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4016
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B816.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1216
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:1288
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{70E56019-FA8F-4B06-A6B5-076424EC3A52}.xps" 133709739434210000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:3228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini
      Filesize

      129B

      MD5

      5a7f7804eed8ed2ba33c3598327a251a

      SHA1

      d0ed967d92213e74a99e97825c20794c999eba88

      SHA256

      52b81cd806d96b8ea874d463fecbc4033f4e5819bd8c870105de7238d445940d

      SHA512

      fe7a41efb84d0c6d7f33b86555f8911c89498f263f1dcd26c1bee1b27a1e0cacbbe7f958f04d4e6a7f705bc2029bb6f2dd55513c131a161c479b27b48df0eb84

      Download Submit

    • C:\ProgramData\B816.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      146KB

      MD5

      6865672ea3cf396a6ff22b66e6ba5ac2

      SHA1

      98493fa9251cfb8db37baae03631bc40bb74f316

      SHA256

      2577cdfda7478395d4f2d83e6586f262d7c4b7a6656c0d5dc5f582bf7d7fc2ff

      SHA512

      644ed456185ff122f2df41104426203bc8e42fba358e928b39f5a5b303c58ed94e691231c49e9311d5e775ea00bb5206ef42e5a04082e6153dcc4e13b15123b6

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      51a6c657d4369bd64f96e7a2e7aae7f1

      SHA1

      d23c23a5e607e9c38f59f1054af5d8c4189ba56b

      SHA256

      0aeb6741209d97a0979718ddd55b0a59efb721eeffda387232aa281d34819ab2

      SHA512

      0cde7cc1112d4019d6f28d328934ca9b2a6868666cc57fcfd83b5117abb23df142d193ff1a03b54220100946f88befb53fbe70b0d7e6b163a1898c256c638673

      Download Submit

    • C:\qcH9iqGVb.README.txt
      Filesize

      1KB

      MD5

      a29ef9eb0849133873e0347ff41135b0

      SHA1

      655879484a9fcce0b7d4187874a3f2ce55fe09f6

      SHA256

      f74a2086f29e6d95213d7af689d6bb780a4fcbb176ac95c89f1b65256f82cdad

      SHA512

      441ae15234f24c60a88c36585f2139022fe52c46dfaee753803826ba05d27a418c4802bde56721fa12798037efd9eb3907a2e3d15df09d22517ebbb45b3655d9

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-355097885-2402257403-2971294179-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      21f144b97b725dd67b87fa3ac6f8c3c8

      SHA1

      dcbe1a040e05fdd5e07b294a97c672e083dfd8a3

      SHA256

      1d25a7f4cbfed3efe0b48a13cae405640c212c72ed6a1e1df643e4183445149e

      SHA512

      4545fdfaf3e4ad8dbe6df90819278f0e31c9231337a8506e7ff31f255624eb3fe355471e30b037e494847fd1f21bf7f84c646e443a98dbd4cc0fb55d2f532e87

      Download Submit

    • memory/2996-2782-0x0000000003500000-0x0000000003510000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-2783-0x0000000003500000-0x0000000003510000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-1-0x0000000003500000-0x0000000003510000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-2784-0x0000000003500000-0x0000000003510000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-0-0x0000000003500000-0x0000000003510000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-2-0x0000000003500000-0x0000000003510000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3228-2798-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3228-2799-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3228-2800-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3228-2797-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3228-2796-0x00007FFBA8370000-0x00007FFBA8380000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3228-2805-0x00007FFBA5CA0000-0x00007FFBA5CB0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3228-2834-0x00007FFBA5CA0000-0x00007FFBA5CB0000-memory.dmp

      Filesize

      64KB

      Download