Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-09-2024 18:01
Behavioral task
behavioral1
Sample
202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe
-
Size
146KB
-
MD5
7e289e2de04d519e94419ccdc5e9fb0c
-
SHA1
3a868a8b93da54dcc18f47f67a322a5ab0aa0178
-
SHA256
c1f9a88541f2175dbe7ac071fa8219e1df77fc7b0efd74c116757b5968ba3405
-
SHA512
a69d8d4c4875442a2d4c07b887fb47a57eb8f9f1be9fe2720d121460f3684334c44ad64da4f24344e5054603dd7e55ca59996ae86f96598de842d9407e826b39
-
SSDEEP
3072:E6glyuxE4GsUPnliByocWep+n9l4Tu3c65QBO5:E6gDBGpvEByocWekn9lY65p5
Malware Config
Signatures
-
Renames multiple (335) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1952 7CDD.tmp -
Executes dropped EXE 1 IoCs
pid Process 1952 7CDD.tmp -
Loads dropped DLL 1 IoCs
pid Process 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\HphEJKWIi.bmp" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\HphEJKWIi.bmp" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1952 7CDD.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\WallpaperStyle = "10" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.HphEJKWIi 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.HphEJKWIi\ = "HphEJKWIi" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HphEJKWIi\DefaultIcon 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HphEJKWIi 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HphEJKWIi\DefaultIcon\ = "C:\\ProgramData\\HphEJKWIi.ico" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp 1952 7CDD.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeDebugPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: 36 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeImpersonatePrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeIncBasePriorityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeIncreaseQuotaPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: 33 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeManageVolumePrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeProfSingleProcessPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeRestorePrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSystemProfilePrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeTakeOwnershipPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeShutdownPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeDebugPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2892 wrote to memory of 1952 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 32 PID 2892 wrote to memory of 1952 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 32 PID 2892 wrote to memory of 1952 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 32 PID 2892 wrote to memory of 1952 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 32 PID 2892 wrote to memory of 1952 2892 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 32 PID 1952 wrote to memory of 2380 1952 7CDD.tmp 33 PID 1952 wrote to memory of 2380 1952 7CDD.tmp 33 PID 1952 wrote to memory of 2380 1952 7CDD.tmp 33 PID 1952 wrote to memory of 2380 1952 7CDD.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe"C:\Users\Admin\AppData\Local\Temp\202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\ProgramData\7CDD.tmp"C:\ProgramData\7CDD.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7CDD.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2380
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5bf9032d7e2bca9290cc72c9f6a375bc9
SHA1c8f206c9274eafcf71a80c487c80284fab715c94
SHA2565eccf538d4af9d2b8c807e4cbd3ce7c8dfb63a875b299c70c5c8bde05a17f0a2
SHA512946bebc5abed48b36b84b318bc1058a3da2fe68c587beab7beef56076320258fd75316674274e9b98380af87a7127329b392582ae68eee413a18b69562c2e40a
-
Filesize
343B
MD572b1ffaeb7de456483f491ecceadb088
SHA1ee1953abc295245ab01f35a4a823883826bf2b41
SHA256eb892eac9899b995047733bb17acd4945eb42b7b49f2ee8ad52b8026bc0297a7
SHA512c0e7cad617cf1490bb25fc47936edc3ae164b190ed34f2d2a50e7e84ce6e0d6712a6ba9ab351cca1589266078326a00317516c53fecf96f20eaefe15e92ce445
-
Filesize
146KB
MD5eea418a765d6dedc57eb4be25e69a13a
SHA1539b905c27dfa38fbdeaf97861e04cab4dee1a92
SHA256fa872b2f903843da7971520b8f614f50cac661349305ca468e3c362215637c60
SHA5120429ff41b94117dc9724f62daba2deb5fa5ea4c0c30760cb00dee5fb9b10669cd8e44c40facfb93d5b9d8371b66bf837c8f31c92242d0670cf90a4e082f4da38
-
Filesize
129B
MD50dda038574a5dd7b8c69305920e45f82
SHA1bdb036e926ca2d49441c5224cc4162338f6fc396
SHA2566fd78d7fab9cbf9779a6b53417c4858a4c7ba4d8e19d3cc426247bb0744a0ba0
SHA51226b749413af546c7c6c033312fecceda3d626c0080a21b522a7ca012f3b345dc845344ed6dcfc2fddb26653c80ec4f6b2977f7c7e5de508c075bd7b797ec050d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf