Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 17:22
Behavioral task
behavioral1
Sample
2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe
-
Size
146KB
-
MD5
13d1cd6bc101aaeabbb33fe9af40be3f
-
SHA1
fdf8e840d9b5241bcf3b458cac72c2fb4d4cec00
-
SHA256
a8bd5d36c5653a89f5643dd7d7ff27146dcc95f0ef7c3a507f8c42af1ee6b367
-
SHA512
80c10fc4b173ff9ba30d0a3944645402995c66b356e079e52e343f7fa8c493ccc2ce4f864f0ab26ebd2eda59108167fc710d7fcab95038bdb3e6c187074d7f89
-
SSDEEP
3072:76glyuxE4GsUPnliByocWepRs7lD9DVGUI:76gDBGpvEByocWeHkg
Malware Config
Signatures
-
Renames multiple (374) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 788 453A.tmp -
Executes dropped EXE 1 IoCs
pid Process 788 453A.tmp -
Loads dropped DLL 1 IoCs
pid Process 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\8mxowyHQo.bmp" 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\8mxowyHQo.bmp" 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 788 453A.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 453A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\8mxowyHQo\DefaultIcon\ = "C:\\ProgramData\\8mxowyHQo.ico" 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.8mxowyHQo 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.8mxowyHQo\ = "8mxowyHQo" 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\8mxowyHQo\DefaultIcon 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\8mxowyHQo 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp 788 453A.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeDebugPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: 36 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeImpersonatePrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeIncBasePriorityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeIncreaseQuotaPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: 33 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeManageVolumePrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeProfSingleProcessPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeRestorePrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSystemProfilePrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeTakeOwnershipPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeShutdownPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeDebugPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeBackupPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe Token: SeSecurityPrivilege 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2336 wrote to memory of 788 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 32 PID 2336 wrote to memory of 788 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 32 PID 2336 wrote to memory of 788 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 32 PID 2336 wrote to memory of 788 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 32 PID 2336 wrote to memory of 788 2336 2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe 32 PID 788 wrote to memory of 2172 788 453A.tmp 33 PID 788 wrote to memory of 2172 788 453A.tmp 33 PID 788 wrote to memory of 2172 788 453A.tmp 33 PID 788 wrote to memory of 2172 788 453A.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_13d1cd6bc101aaeabbb33fe9af40be3f_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\ProgramData\453A.tmp"C:\ProgramData\453A.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\453A.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2172
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:2896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD567876fbcc9c31b0c139487d48b2415c1
SHA17590081c3a158f1478d330abdfe4c4359f78447e
SHA2569038ab6f1bbf30889f492b7d6470215989ffa6110e4a666f0aebd6c64a6b8b8e
SHA512f2552800c9951026d24f76c5c9ca9fd0f4f30f6cedf837b1149ffbb19c71cdb2fb0b9b85a5fbe36cd1dd1a9a8559cdd21fb1b26606a67206f8602fe4f07a48fe
-
Filesize
343B
MD572b1ffaeb7de456483f491ecceadb088
SHA1ee1953abc295245ab01f35a4a823883826bf2b41
SHA256eb892eac9899b995047733bb17acd4945eb42b7b49f2ee8ad52b8026bc0297a7
SHA512c0e7cad617cf1490bb25fc47936edc3ae164b190ed34f2d2a50e7e84ce6e0d6712a6ba9ab351cca1589266078326a00317516c53fecf96f20eaefe15e92ce445
-
Filesize
146KB
MD5ba749dd4cf582518bf1aadd856f21aaa
SHA186e542bded4737f3673b29af89234a8fa1c84d55
SHA2566fbcf7c7ee40c56754528e2b62f9af70c0897fd4dc7c0cd25a265413a4f2e0fb
SHA512b1340954337ceee84c14d32b4a7c7fb1aa35f4015b92ca73d5f5a73d5d620ab14f5b757748b4098b3bc2b39a8a59e847af450e45c0b659c051774810f2c00eac
-
Filesize
129B
MD5ca29f0041b75c92cbc5d33d719304c37
SHA14362707b64c57070dda80ba5f8e078291b4c4153
SHA2568eb3f7c12569f29002d014a135176b98d8364ce1a111e86d4868a130dd850f75
SHA5129c693b1c08ca6f639c4c27bb9098d74990ff179618124891425a12867cf43ecd186cfcd1d8042953139624b7bc85368fd7c9d25cda4e01ce9482b14e58af2fe1
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf