Overview

overview

10

Static

static

10

2024-09-24...de.exe

windows7-x64

10

2024-09-24...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    102s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2024 04:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-24_ef7eb0e31e5ef78258750ce2c9d2428c_darkside.exe

  • Size

    146KB

  • MD5

    ef7eb0e31e5ef78258750ce2c9d2428c

  • SHA1

    e16d0b8796f9c745a195c0dedad9945b7978c553

  • SHA256

    3cbf36af1e82cb4ee52facdefedc1eb5e5823242721c81f12f14f8657773c9f9

  • SHA512

    8cd326170f92762cdecc69f6b27a8f6220c4cb547750dbd2173afffba36866501372534b37bfbf057faa039cd3877a627041c53c30d9b9d2f2d054b036629713

  • SSDEEP

    3072:I6glyuxE4GsUPnliByocWepXjZ3Csy+hs4Sf33Q:I6gDBGpvEByocWeNhvSfQ

Score
10/10
lockbitdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\sOZaWmhTR.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us with your personal DECRYPTION ID: D935BE7A0BBC77285D6CF9E3C2F9B653 >>>> To contact us: 1. Download Getsesion https://getsession.org/download 2. Add friend my id: 0576f87ce7ad049d7f1e24cab3780853b589bcfa9601302eb005c041f3a504fe7a >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

https://getsession.org/download

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Renames multiple (4126) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-24_ef7eb0e31e5ef78258750ce2c9d2428c_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-24_ef7eb0e31e5ef78258750ce2c9d2428c_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1592
    • C:\ProgramData\2932.tmp
      "C:\ProgramData\2932.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      PID:1012
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x154
    1⤵
      PID:2228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\AAAAAAAAAAA
      Filesize

      129B

      MD5

      c0f7265770b227fdadd4c70cfb857881

      SHA1

      eacd65405389e15e70b6fe4252ac6d2e457cf682

      SHA256

      88c3e8c4ef8cc285497fc601b7ae4e7d1d9f582271c38021f575ddb413c8ddae

      SHA512

      c466ce0168b189d16fe364ecb654ea6b104175fe53240ae92bbeb20dd43a3e6060a1da2106ba89ca3c7f41873c018fd90a132e4e3fa938fee926cca05c2754d6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
      Filesize

      146KB

      MD5

      fee62b00a9558302181d197d5462d43e

      SHA1

      329a93a4b229aca7b32766077ddd476da44d63ea

      SHA256

      8ff49df3617ba9d359237e84aa7e413eeedc7c0208db7ebdaaabf4c6c41df1ef

      SHA512

      1e9f7751e9718e3de79aba602804f182ffebd6eb6436e523c38523c7f92476090a89c77c8ff81bd677d6e0d51b67903c6cd548be91a86923df156cfd1ec3f5c5

      Download Submit

    • C:\sOZaWmhTR.README.txt
      Filesize

      1KB

      MD5

      66f83c14a667b6cefc6f9c970ea74c63

      SHA1

      9749f990d196e486fba5d8848916fd9c08852dcb

      SHA256

      47c83392bef30c7b3df5848b514a7e2345c24848b0a85792252c0a581c4fab93

      SHA512

      7ceec45de8aa89320816950c8960d68b2120c10759814a3de1a88331500bbb8e241af462dd97a3a51d01a3fb67538592f6880415e1aab734f53caa8b91f8f0ef

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      8abdb521ed41c9cfe0ea3acff0a2aaea

      SHA1

      9342ddfed75bbc3f5822511cabf9c3c609c6a01d

      SHA256

      fff41603adde7a509741a6edcf0f5d0c1d602817537c2c2aede61925152e4502

      SHA512

      8f3d9d7c5906e022574c2a9e34acbaae20602e6b9ac54500d902c3aa888346644a51c90b6c65f3c918137ac0b72d39afdb30a53031bd7647884f45e65704d9b7

      Download Submit

    • \ProgramData\2932.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/1012-9844-0x0000000000401000-0x0000000000404000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1012-9847-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/1012-9846-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/1012-9876-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/1592-0-0x0000000000DA0000-0x0000000000DE0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1592-1-0x0000000000DA0000-0x0000000000DE0000-memory.dmp

      Filesize

      256KB

      Download