Overview

overview

10

Static

static

10

2024-10-04...de.exe

windows7-x64

10

2024-10-04...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    124s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2024 00:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-04_23f8091893512fa2635817a2f51df391_darkside.exe

  • Size

    146KB

  • MD5

    23f8091893512fa2635817a2f51df391

  • SHA1

    9f7f2ba48752e37baadd4c35febaa58d613e3194

  • SHA256

    7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1

  • SHA512

    b4b9fc55bb944c8c657cf737ba0c8de17a09ec121591faac468b9c89182d45d910301f248d78134d78504de437a124208b6038a0047503f65e6cd1125490755c

  • SSDEEP

    1536:wzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDY4zGqaGKGcNY3XZ2Vsz1bl8HXo:PqJogYkcSNm9V7DLzxaGb522l83qtZT

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\mqmQaLLxg.README.txt

Ransom Note
~~~ LockBit Black Ransomware Since 2024~~~ >>>> Your data are stolen and encrypted Price = 2000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: NEWWERTYFG34A48MK4D6D53 + Name.README.txt >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Signatures

  • Renames multiple (12916) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-04_23f8091893512fa2635817a2f51df391_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-04_23f8091893512fa2635817a2f51df391_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\ProgramData\258A.tmp
      "C:\ProgramData\258A.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\258A.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1544
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini
    Filesize

    129B

    MD5

    f3981a76dd8c7e7984b8397a1e87ba06

    SHA1

    77d07ba489e8c1a9d3f5a5ac188d9b0bef21cc8a

    SHA256

    392a2a4d4a71ef8621159f74f68432ca9200bce75c462d431f86fca7fdf653cd

    SHA512

    4fc3ab6a39e094bbf35e48086a2d8a94b6c3b296930928f4f54883bf9d87fbc9d9074a990ed6e27a49b17664bf51ff38623666dcb33cd83252cc8403a45129e0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    146KB

    MD5

    79d197a11c0e838098b7b231b5991933

    SHA1

    85fb9c903a3b527a11ea53de3ae894270488585b

    SHA256

    ff4c8304f28d25e473f7eed3345fc530b1638f3e4427d2be5348caa265e4a1ff

    SHA512

    e14d819fba484d7a28cb3f22f3b1bfc92412ace4922f6ba17eb2923fa42cab391739e428acc9b0520d4cdcbf4cf9af19512db57ab3224ee9e420331e7cda078e

    Download Submit

  • C:\mqmQaLLxg.README.txt
    Filesize

    1KB

    MD5

    e660a65fcf9340820aff87745a4b9074

    SHA1

    161bfd683350ad551ce3a6652ba43bc4f447811b

    SHA256

    1a0ff740dcfbd23a131c794c9b43a8cf3578b361814e89987a8ca752c936cd93

    SHA512

    74f332c787ae1af6369c78c072c0dfc6b5148bd5f5b95ebb0c8d5f593925d083b0a28f2e54623d12599980473fb6d541ddd8b786d0f18fd9833ff71f2790a44e

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    16f82fcdca68c3423982ac78596bbcf7

    SHA1

    43b8b718b340d3d6b9c6b22e164473d411abc244

    SHA256

    5bd654ebb076d2362af1509234e12cf5db52ee386e1959c6271bb87cc99845b0

    SHA512

    5392bac3df27872bebd6b053ac33184af3c0dadeb85eaca9ac0e06a021ebbfd988daf1d994127ad8e320bbb233d0cd59ada9f95334ffda1b9b77d17e6b78d405

    Download Submit

  • \ProgramData\258A.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • memory/1968-22059-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1968-22062-0x000000007EF80000-0x000000007EF81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1968-22061-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1968-22060-0x000000007EF20000-0x000000007EF21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1968-22057-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1968-22091-0x000000007EF40000-0x000000007EF41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1968-22092-0x000000007EF60000-0x000000007EF61000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3012-0-0x0000000000DD0000-0x0000000000E10000-memory.dmp

    Filesize

    256KB

    Download