Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-09-2024 01:03
General
-
Target
2024-09-21_6108e5ec22ef67c52473f04a6f68b91a_darkside.exe
-
Size
153KB
-
MD5
6108e5ec22ef67c52473f04a6f68b91a
-
SHA1
ef45fd676e04c5506e7d8f383aabd96396012539
-
SHA256
442037de029939e4c234fca54a621c126172482afcd4a832beb24715df7d8235
-
SHA512
bca74b79dab4c2d80a34aac87250f7652fc969e50928669f804b024155bf7fd2526198769df3f84ce0d93977fee21c8caea3cc5c1083c2b9cf66f17c9f28024a
-
SSDEEP
3072:uqJogYkcSNm9V7Dl7GbPxQgr9dIZyhhyT:uq2kc4m9tDl7GbPnr9KZe
Malware Config
Extracted
C:\Sjn6OybIL.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_6108e5ec22ef67c52473f04a6f68b91a_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_6108e5ec22ef67c52473f04a6f68b91a_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\D5EE.tmp"C:\ProgramData\D5EE.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D5EE.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{58BEE53F-1D0A-40E1-AA51-CE2659767ED2}.xps" 1337135420226900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD52ffbfc0e3e107347bd511cafc874f1fe
SHA1da655ae82c79b7bcc1ad088d0aca0b27354805b4
SHA256097f3496eccedd9701ec6b410c1b5beef8403c8f4dda920ee00f39650401635b
SHA51274b6b9e0d0d23fd7b5799bb09cbf3ee979fd9f30b11ec8bb4ce19e52d03823cf74f72b23b895aac78b38cddf8f923fce5e13308875155a7ecf37f711562b0bbb
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
6KB
MD5f9366230690f4341bc9c9d958d042cc0
SHA19ae05629d0cee0b7e0d1a87e0ec812575c7cfe68
SHA25653e1aff3d9bdee7c6c0068f5553d88fca8f1399007fb47372717397d06d8f433
SHA51242af70bc2e1109633e259fc8a65650b1d8ff4d41456abcb39b4aba80c68d711192f2a21da3c9889fc71e7624692f0ddd3216c570ad8b67c48f09f180f11f8931
-
Filesize
153KB
MD52ae85204a4e01606309fe9ef7223dbb9
SHA1528a56d6d2bbdf80a509656dff10e84bde1e8a04
SHA2560c8a6e2cd24f32b12743f28cddd37adaa8b6cdffebfdfa694c5c10589f9e8f93
SHA51220cf1ce12a5d4a9543458c89ff3c2d8dd6fc9aa506ac27abc5be59ea1feb6ee674dc4b1e9bc253474a709167eb59e410c648888acadf3f795b1dc3d9c2598eaa
-
Filesize
4KB
MD5779d0b764163310e2ac10652d5986d8e
SHA1e98dd13c4a4103eb4fb15bcf8e633dcce79b6b84
SHA25697dc6ed2565867a9ab02717ad9dea3f41a716e41fad9293251e3215f12bc16c0
SHA512d192115d04673bb56f45a32e0627176f654c9a25a23838679db63b3259001c00f855b3eaccce1866ea85f7d1e8a60527cb57b5cfa3985fffe98bcfc5519b5888
-
Filesize
129B
MD5ccb28689c831013a36a720e1a0f679c9
SHA1d375a7945c386451704fc08806230bfff3010cd0
SHA2564d058e34d9a656a045b582a9144c9acf9c47ff9be20b6b59e025632ae1ecc237
SHA5126bdc64293ea226787668800c20b12a164da7ba6fce48af994e4c75c5772e4eae82504b342e10d95e75286cf71c9fe140817f96ac88d49bef8899b7b9d9c50b47
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB