Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-09-2024 07:28
General
-
Target
20240924ef7eb0e31e5ef78258750ce2c9d2428cdarkside.exe
-
Size
146KB
-
MD5
ef7eb0e31e5ef78258750ce2c9d2428c
-
SHA1
e16d0b8796f9c745a195c0dedad9945b7978c553
-
SHA256
3cbf36af1e82cb4ee52facdefedc1eb5e5823242721c81f12f14f8657773c9f9
-
SHA512
8cd326170f92762cdecc69f6b27a8f6220c4cb547750dbd2173afffba36866501372534b37bfbf057faa039cd3877a627041c53c30d9b9d2f2d054b036629713
-
SSDEEP
3072:I6glyuxE4GsUPnliByocWepXjZ3Csy+hs4Sf33Q:I6gDBGpvEByocWeNhvSfQ
Malware Config
Extracted
C:\sOZaWmhTR.README.txt
lockbit
https://getsession.org/download
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (632) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240924ef7eb0e31e5ef78258750ce2c9d2428cdarkside.exe"C:\Users\Admin\AppData\Local\Temp\20240924ef7eb0e31e5ef78258750ce2c9d2428cdarkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\7327.tmp"C:\ProgramData\7327.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7327.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4212,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5da9036c683062c923e1a4b772d9ee834
SHA1147736f99eaccb3450f1ebbc1d4d25f6b3316ab3
SHA256a34cf56c231f00c3c87101633d5c32f3fb8b54181c551ab7afe78a63bcc78310
SHA51227f194e46e25288e51b290f46b6092ba32c3b164d5021b085ca2b7e2f7efbb6ffa7eb9c2ae3b476a85e67d9eab920c537d55854e5f36cb538c9b8708aa2021e0
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD5cb6ee649107d1336c7ea78b170d49f76
SHA16b1e7e512b4ee56a335a9623f275e48d29663bb1
SHA256114ca4bb152624884fdec18c3594c717d17d3ffa1d4b7c67df7722865eaec153
SHA512e2395d1cb7d618755fda6c9c185ed02d044d3eb98190e5dd1b7cfd5cbe7c1af8fd0b48f324e13cf96c77267bf884bb2a813fd2cc26f196ba5c949f861ab1080f
-
Filesize
1KB
MD504edacb11955dbe7515641aa81767eb7
SHA13ac0c48b352d6f9b34a22a56bc8b8c4789dc2ea6
SHA2567d9f4b724d62ee3698fbe591212da3f058df2914fcd7143475572100f7a2ae15
SHA512855ee26d3c652e931872db1ad371c06b8ae4b90c6ada02cb5560c2c76b518175d30fad5418b8a1b8b60c7ba148c9f1bac6b2367f4460a3822e0f5d719b966445
-
Filesize
129B
MD5aacf923913360a02d92fdced86d76b2e
SHA1d01534cba8d5ee7e4403341e8bc32236b8a877f7
SHA256ce78964d9830ddf732b9096df060bfd526a7918d3acca360b07db626def4b732
SHA512774b49404429f7d149d69ff86361146fd4ae86e5694702b9d853b9824863d248132d341f98e576760c09e654e6603f92e14660fa72bfd27a79498c4c3feca410
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB