Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 04:50
General
-
Target
2024-09-26_76a0d2ef15e408b4a07f534c8d056b30_darkside.exe
-
Size
146KB
-
MD5
76a0d2ef15e408b4a07f534c8d056b30
-
SHA1
7ddc10e637b0ab439b80a193420b00bcf03c3dd7
-
SHA256
2317d33628eb06af24d1d6d94ff892d6fb6a7ecca24094d477f5c77829ca35c0
-
SHA512
48f709fe69c2aa219ee40167f1f82806fd003b697b6ecc96aa87826670b12533530a9314a4a642e92784ef59b4a97628ab27a4c781695a37d946ca624f6fff67
-
SSDEEP
3072:D6glyuxE4GsUPnliByocWepOsNPfGk21h:D6gDBGpvEByocWeqN
Malware Config
Signatures
-
Renames multiple (195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_76a0d2ef15e408b4a07f534c8d056b30_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_76a0d2ef15e408b4a07f534c8d056b30_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\E9C3.tmp"C:\ProgramData\E9C3.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E9C3.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD56b6a5d3695de86f16a513bc59445d6eb
SHA17e51a6f78db0d948d72cbd43618ff353ddfdbc2e
SHA256313d5430be575f4136b601d215c58e0cf0fc5d4c0a25588632b96aafdcbcb482
SHA5127545d1e1c0a68ec1ead0ff64bf57f2cbca100faf8a589f6528579984d8ac93c033d09d6651d249622d68d9515eb3b5907c5b6611eb331a0f5aa0775e56dbee40
-
Filesize
463B
MD56f7db6bb7b29b288b16771cd09f495e6
SHA1ab4c0ef134b8c4fefa75acd18c5f88d6c6870b58
SHA25695d26fea78a10ee5d82d4de5e16bba8077ef038139b3c0fcf7519f2b4c813518
SHA5128ce9df614eae8036043d85d9c3e36d0d0e464e6d3ae288afd6ad538722ef4e48d8910cd2bf34004f7415a6c894654f03fe0f2eb3ffea67e333351818b2d5edd9
-
Filesize
146KB
MD5fa8cd45bd907d41b17a121147f4a319a
SHA12030ada2b00e8bd1775ceb0113c3a9aafa61e778
SHA256e126409f6b01e2ce5e2e7e2032d7d8b24a5978beda865cb69cd0049bbf410cc1
SHA51252da1c0042e47ed0d6fe832207e286fa88be0c9b4b858c5177803fb72779ab99e335883b6b7ce88fff2c4193dc9b52a4eeb2a561a1b71febb3885952259a0d88
-
Filesize
129B
MD503ff2afd803963cc0c99d5a6ce6931b2
SHA1c94b1c62c7e55b7e7333460a3c5748946dc0499b
SHA256b53967d749285c659b1c4a2aa586ca1cbc9b6fc5f70d1b1f2eb43fb4a532a78b
SHA51209aec4243be04d9693ad46f585feb59e5f1ace51c89ee05a1087d997e665e1be7ab0f6525b2bc5e4aa76440808ef3b41d4d5aa5c6b6e40a416a19a2cc76d4d82
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB