Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-10-2024 07:49
General
-
Target
2024-10-03_9c70caed1f0c37a7d891f22f5e6ac297_darkside.exe
-
Size
145KB
-
MD5
9c70caed1f0c37a7d891f22f5e6ac297
-
SHA1
8a1f61df4627065a5977033b42654fb4ec85be19
-
SHA256
f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2
-
SHA512
c54a137cb0439a1cd8040f3e12e0f6dbcfedb99db2135d66e7d6667a0298bc920118c909a5545555425df8149ac1fe321fb1e4bf43a2782831dfbc2ca42de645
-
SSDEEP
3072:DqJogYkcSNm9V7DjWWumrIDNd7k/PHm2T:Dq2kc4m9tDaWumrIDNm/u
Malware Config
Signatures
-
Renames multiple (654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-03_9c70caed1f0c37a7d891f22f5e6ac297_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-03_9c70caed1f0c37a7d891f22f5e6ac297_darkside.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\C302.tmp"C:\ProgramData\C302.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C302.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5c1f5733650b3add97d6d8fb4b0d3fe38
SHA107dfe418efe9343b1e96f383ce38aaf366a56c3d
SHA2561989986a53722f0b9a3b24f2a248699a96f2a7d3c2da6cda771b0546ac0f27d5
SHA5121d9a3dd154352d6093c6a71a1699b70c08cbf4c250442b05112d3c805064a6a8401a59980947ccf23c192d8ddb31adbb707bc19eb29ffa5a652ed1e855ae15a8
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
145KB
MD5cacfb7f19a6b355fcd68ed64f1141ad3
SHA1d81a41d5f5b92ea912599938a806349ee3d42b26
SHA2562ac9ffb298c4c236ec0db2d1a9dcf961daa2098335041fa28843a8e1ac291920
SHA512a6c198740341300df4e59f49132e8c05a9d5400180155bdc59e225dc259cf92b1ef5af0661a96b795980d5c95b2e996524a11140a62c814c86441fbe0ef46996
-
Filesize
129B
MD57162e73fe30d88d6c91ff9900ba6bed9
SHA110f4acff8844aabc11a3d2a615a34c61e3709040
SHA2561c6b195d73af28a1252cbde90e31bdf2dc857f3f7d833ca1cd727d8c101447c8
SHA51266ade7779679155b6d726ee9816f84d854b5e0bc7ff13d9ec34e0abef15eda21defb6c0eb219550ca5ac6747809f96d48b53fbf74414abf47b24c020774612b4
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB