Overview

overview

10

Static

static

10

2024-10-04...de.exe

windows7-x64

10

2024-10-04...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    130s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2024 00:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-04_23f8091893512fa2635817a2f51df391_darkside.exe

  • Size

    146KB

  • MD5

    23f8091893512fa2635817a2f51df391

  • SHA1

    9f7f2ba48752e37baadd4c35febaa58d613e3194

  • SHA256

    7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1

  • SHA512

    b4b9fc55bb944c8c657cf737ba0c8de17a09ec121591faac468b9c89182d45d910301f248d78134d78504de437a124208b6038a0047503f65e6cd1125490755c

  • SSDEEP

    1536:wzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDY4zGqaGKGcNY3XZ2Vsz1bl8HXo:PqJogYkcSNm9V7DLzxaGb522l83qtZT

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\mqmQaLLxg.README.txt

Ransom Note
~~~ LockBit Black Ransomware Since 2024~~~ >>>> Your data are stolen and encrypted Price = 2000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: NEWWERTYFG34A48MK4D6D53 + Name.README.txt >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Signatures

  • Renames multiple (12913) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-04_23f8091893512fa2635817a2f51df391_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-04_23f8091893512fa2635817a2f51df391_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\ProgramData\842D.tmp
      "C:\ProgramData\842D.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\842D.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1940
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini
    Filesize

    129B

    MD5

    a7d794da3d25f67aae078227dbae6cc1

    SHA1

    e50e03bce9e6ce9666087e4e355c64fd2ddaea01

    SHA256

    2d98e652c8ea2d26ea9c3d767957008810d9505a8ef7ef1e1f08db3437d31758

    SHA512

    b3d18684770e831e30b53365005269e5e19dfcb438cf9ff2000904137bc6de953cd7b99b114e82c74339548e4c10d140804af8bfcfb20c52e5f4975384dcd727

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    146KB

    MD5

    a8350c6c20c51d4463eecd5b508f0bed

    SHA1

    f1a1625c2468ee912682cc0b76f6ead9e363126a

    SHA256

    6316d0c2831d10f552bff04f4432be37964bf2956e180e256410627b5921469f

    SHA512

    3881192066948461e21750cdb25f41f497da03b57ef2a0e2228100aabde1134ababc772a6d8f9c6dd53e687519e6baee4feac0608235cf12e51cb5eb4350aa23

    Download Submit

  • C:\mqmQaLLxg.README.txt
    Filesize

    1KB

    MD5

    e660a65fcf9340820aff87745a4b9074

    SHA1

    161bfd683350ad551ce3a6652ba43bc4f447811b

    SHA256

    1a0ff740dcfbd23a131c794c9b43a8cf3578b361814e89987a8ca752c936cd93

    SHA512

    74f332c787ae1af6369c78c072c0dfc6b5148bd5f5b95ebb0c8d5f593925d083b0a28f2e54623d12599980473fb6d541ddd8b786d0f18fd9833ff71f2790a44e

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\EEEEEEEEEEE
    Filesize

    129B

    MD5

    e68af08380eb257c0c764331f9e8c423

    SHA1

    02260b8e65ededa9632a75cc708b62773f14c244

    SHA256

    1c7e7a6688bb04bb44736d1271cdd5d10219dd9b11878569721771e5f305ceac

    SHA512

    d0f60293e229445d6d6c2e7deffdb47364026b1dbdc2eb5ec2ffbf928476b175b0ea8f3cdb55bb62ea482b9a7cce66dead751bb1d69242d289b85152fb1261d7

    Download Submit

  • \ProgramData\842D.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • memory/948-22050-0x0000000000401000-0x0000000000404000-memory.dmp

    Filesize

    12KB

    Download

  • memory/948-22051-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/948-22055-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/948-22054-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/948-22052-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

    Download

  • memory/3020-0-0x00000000000F0000-0x0000000000130000-memory.dmp

    Filesize

    256KB

    Download