Overview

overview

10

Static

static

10

2024-09-24...de.exe

windows7-x64

10

2024-09-24...de.exe

windows10-2004-x64

10

Resubmissions

24-09-2024 02:38

240924-c4vjeswflc 10

24-09-2024 01:36

240924-b1m5hawbke 10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2024 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-24_8f07589938ea42db794ebef25c755965_darkside.exe

  • Size

    147KB

  • MD5

    8f07589938ea42db794ebef25c755965

  • SHA1

    aa6f9576dfc56a6fccb37d9e70ed0bb441e084e8

  • SHA256

    8cdabda0c32376426e32048c867b7d66d9df6a3f0da53baef67e1a30abd444b7

  • SHA512

    79e553062ea5e4de34245bc9e8e6a26db2823cd12d51995e401ebfe47ece36a0a7819a2cad79bf14894a1ca30c9a3587a6101b7e8c3ae1432351deebe8fd86e8

  • SSDEEP

    1536:ZzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDYediJW5QdpkLMuAkHiWIlqUyz:iqJogYkcSNm9V7DFEW5QAQrRW2qT

Score
10/10
defense_evasiondiscoveryransomware

Malware Config

Extracted

Path

C:\LOyx4shPX.README.txt

Ransom Note
######################################################################################## YOUR COMPANY NETWORK HAS BEEN PENETRATED All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. YOUR PERSONAL ID: BtVU0r1vpQsdlbLPcJmi8jToR3hqNAaz6fZuMx9gH5kyEOwXYG2KeCFn Contact us, use the email: [email protected] [email protected] IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Signatures

  • Renames multiple (155) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-24_8f07589938ea42db794ebef25c755965_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-24_8f07589938ea42db794ebef25c755965_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\ProgramData\9CEB.tmp
      "C:\ProgramData\9CEB.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9CEB.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1572
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:2628

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini
      Filesize

      129B

      MD5

      f252471f1b7e7b52cb334f35a1f77784

      SHA1

      923e68ff92bcfd917b3659726295e697ecd7e014

      SHA256

      5cd41251ee3c4f57b1a35949e9cf218742d7f6d8464b2c822502ab14439090a1

      SHA512

      452bc9546a4dd9aa45ce527fd9c38466054fd674a0a87cbf76d83e460b48b2d5ce549907b23c54d53f6db1fc14f0842303fc72ce09c9fab83b060cf170163605

      Download Submit

    • C:\LOyx4shPX.README.txt
      Filesize

      1KB

      MD5

      88cf2517f115408ab7aed8c749642095

      SHA1

      18d3e6939413777568c48969d034325dac990826

      SHA256

      db34f0ce8a7806f24be30cbb2fbfe4b1d2a54fc0aa15f1a6bb0bb8732222ae77

      SHA512

      027517ca25064985f7f085704e0a77622d86cdc390e386ebfef8f758b6b0bf4f9dad9f088478900a6d399f8bb95d0197949ff62b71f2815cbdecb7909f43aad3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      147KB

      MD5

      56672dc0644da9a935269e9fcdfc217a

      SHA1

      dc869569e7091ded92157460ae5e3cce73fb7ee7

      SHA256

      328999623ea727591898c9928363997ab539b7a78bbf2ff65701ba36be1a6b5e

      SHA512

      46503308702a7b59c64033cf396ceed4891d9da907a8e54cf70caf8a9617795865c361e97f73f92f8ec8d6e308e0a5af30315394e52bf7c4c39dcbeebe6ce484

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      51335799dff6780d55a92b90c0215bf3

      SHA1

      d105197af3721396edccc5f1da7887511f163dc5

      SHA256

      e9e463bf6e43eb4b3e52c4c902c2a8aba6530951fc2f9cfce101e5dc55617f78

      SHA512

      ec969291f6bafb41bf05880eca6934a0706fa183f6c0b5633006fb225cb608f486c31d4f8ceff5fad031bd1aef3cbd612ac1b88cc1b5e35965c3229e4306af0e

      Download Submit

    • \ProgramData\9CEB.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/2120-0-0x0000000000E60000-0x0000000000EA0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2696-286-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2696-288-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2696-287-0x0000000002240000-0x0000000002280000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2696-285-0x0000000002240000-0x0000000002280000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2696-283-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2696-318-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2696-317-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

      Download