Overview

overview

10

Static

static

10

2024-09-24...de.exe

windows7-x64

10

2024-09-24...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 04:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-24_ef7eb0e31e5ef78258750ce2c9d2428c_darkside.exe

  • Size

    146KB

  • MD5

    ef7eb0e31e5ef78258750ce2c9d2428c

  • SHA1

    e16d0b8796f9c745a195c0dedad9945b7978c553

  • SHA256

    3cbf36af1e82cb4ee52facdefedc1eb5e5823242721c81f12f14f8657773c9f9

  • SHA512

    8cd326170f92762cdecc69f6b27a8f6220c4cb547750dbd2173afffba36866501372534b37bfbf057faa039cd3877a627041c53c30d9b9d2f2d054b036629713

  • SSDEEP

    3072:I6glyuxE4GsUPnliByocWepXjZ3Csy+hs4Sf33Q:I6gDBGpvEByocWeNhvSfQ

Score
10/10
lockbitdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\sOZaWmhTR.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us with your personal DECRYPTION ID: D935BE7A0BBC7728115A5CEF459B6445 >>>> To contact us: 1. Download Getsesion https://getsession.org/download 2. Add friend my id: 0576f87ce7ad049d7f1e24cab3780853b589bcfa9601302eb005c041f3a504fe7a >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

https://getsession.org/download

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Renames multiple (637) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-24_ef7eb0e31e5ef78258750ce2c9d2428c_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-24_ef7eb0e31e5ef78258750ce2c9d2428c_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\ProgramData\BE4F.tmp
      "C:\ProgramData\BE4F.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BE4F.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\TTTTTTTTTTT
    Filesize

    129B

    MD5

    2642edd3ad47c58bead0fe0a9848e6be

    SHA1

    2f44bc8a1b277ed5cd5f54ddfdcf45a459c3e5c7

    SHA256

    5a7c36063e3da5f52fef7652336086a882b24244addaad67a079fa43c0f52825

    SHA512

    d30477084565d3e8ed9e8d44a6fea25d4682d61d7277f9b32d77c0e9051ec854fe55ea30fabfd3324c1c8a6f9a63cb9783f2fac7fae34714ec7b096f54a16e7d

    Download Submit

  • C:\ProgramData\BE4F.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    146KB

    MD5

    b2839a19dd6aae1e29acae22611239e6

    SHA1

    7612fc2499e234354b824a46062cc62009d377ad

    SHA256

    6cb8d0a2d6ac199a17a70a9b8fb1f0927d7b4da50f28b109c05a16152df13b24

    SHA512

    b1c0d9ed8d3b58cbd87f7cdd44379e379d1ab18df1141cfb30d54f124d559ca27103889eeee605e4a5453b066cba911e56cccfce702e587bd6f54451dd1db2f0

    Download Submit

  • C:\sOZaWmhTR.README.txt
    Filesize

    1KB

    MD5

    6e68355fcb8efedcc794e71127c0884b

    SHA1

    677fbf15b5919f5826a0be304d9a4a41765c592a

    SHA256

    b6eb84aaa9ccc6f71bc4a4933e34da8ef8781816bb4850f9377097331fcb381d

    SHA512

    14f24f3fedcbabce191876509c4de0f5e9d73b2be59a766c91c8cee913aaa4663f872373e7f7a4c73b65411b3e6b666a46093e69f25bfea995ba8d965421c082

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-945322488-2060912225-3527527000-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    74483872dc783ce6f8f6b99c7f448c0b

    SHA1

    e0b650fff838b5d2956ea843f475c1d51782e945

    SHA256

    6e076718bbfaf0e3c745153b5df304ad6d512107d376f552680e71d6c04edbf8

    SHA512

    fbd6e6723dcd19e191350833969c87534571e1ad40add58f167edbf86752cfd09e7af2443a2f665e4dbf3b926895d31fda851f59ebe60da90135117eeb28bb0d

    Download Submit

  • memory/1116-2827-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1116-2826-0x0000000002670000-0x0000000002680000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1116-2825-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1116-2824-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1116-2856-0x0000000002670000-0x0000000002680000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1116-2859-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1116-2860-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4104-2-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4104-2821-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4104-1-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4104-2823-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4104-2822-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4104-0-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download