Overview

overview

10

Static

static

10

2024-10-10...de.exe

windows7-x64

9

2024-10-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    146s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-10-2024 01:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-10_a7be144ff0b871ddd45e1e0bef06faa6_darkside.exe

  • Size

    146KB

  • MD5

    a7be144ff0b871ddd45e1e0bef06faa6

  • SHA1

    811797d3e0ce7c5ed76ff656156a2c066f306032

  • SHA256

    22a164ed481ba88df26ce7e819f2240d7fafa5b6ee2cd2993cb5fae3d566be7f

  • SHA512

    caeec8ed5080f00fe1134b968c81f13660ac1a9312d1f151b676f2a0b3670b2c0440e00c8a5e398d91707be5989d34e547ff3d5b4facbba81705c41f52bb3367

  • SSDEEP

    3072:46glyuxE4GsUPnliByocWep0AMmr7fTP+Gldf:46gDBGpvEByocWeRMa3P

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (632) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-10_a7be144ff0b871ddd45e1e0bef06faa6_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-10_a7be144ff0b871ddd45e1e0bef06faa6_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:4388
    • C:\ProgramData\900C.tmp
      "C:\ProgramData\900C.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:468
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\900C.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3340
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:3572
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3E3B4121-E538-4C0F-B86D-78933979E9D8}.xps" 133729969884920000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:3508

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\FFFFFFFFFFF
      Filesize

      129B

      MD5

      410e2769c659fc5dfed3301bfd81f7d6

      SHA1

      4a7c847734fe18cd2b5800d45d51b9808868c891

      SHA256

      01b7b671a2b6039aed5fd2eaf79c284cd8f1a51e6d849218d6e2f0b789df320c

      SHA512

      0f82bbfcfcacb1e661fe769007d6866ca25df6fed4cef6f72382332b925c46b9aa269cd398303112bbbda15e78f448ab0b81b6596db98bec89b19c7c40ea4810

      Download Submit

    • C:\OC9oMrMV8.README.txt
      Filesize

      343B

      MD5

      a8864aa0987b12bc59008a02c3ddda88

      SHA1

      54327dba296f734aae7ba65faf0b3dd8cb73b714

      SHA256

      168c71031668b64e0ccf26e81353f6eacb3599edbaf62f7aa62c55b8075a5a8f

      SHA512

      5a94b41a4f74354978c32dbe18d505bda8db0a0195f1df1749f81478c0bc0e022b744972f0c491a33b595fc9b21c7b5b59252ec5451b14cf15cbb6c936954dd8

      Download Submit

    • C:\ProgramData\900C.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      146KB

      MD5

      01580cf96993cc3fa8ea051d58a916da

      SHA1

      0d4365d45549c7e608d79cd3956cd7c0d3e8db79

      SHA256

      c95ed8405aebfc32bed256300561b8890b53e67697cce8ad009ec6ab31ac1d6e

      SHA512

      bac6223af02fe0bcd188172fa3a509999083ae651ba6d17dc5ab2b04f029a3b55729af00fcbb3019a1471fc584fa6fafffcdb698572178eff47ee2dfbaf711c9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{519BC936-5F7E-4F0F-80C3-5C207D1B76E2}
      Filesize

      4KB

      MD5

      70f571a4e02771332add6b80f21ab56e

      SHA1

      2d1447a820b1ae0eaf6da6a640718024fc13d04a

      SHA256

      df575bbf81712e86477fd2ac206197cb26b44a5cf2a896f1afa50e855f289f32

      SHA512

      ef5825df636dd63275e8dc4ae3dd74f9d119a0e42031184f820288573d5f005a8a6c7a6f9a1ba535a246a7b396356a7e2c27ce32dfab98b9daba8e190676c106

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      b099cd47b8f41345d543a4d348e0570e

      SHA1

      327f8e5aa3fc72f7c641aa8b2c0ae45a339c19cf

      SHA256

      7e9006687aef21dcf39c5986cb6e310cd016b8740931741e079189da9f67e25c

      SHA512

      4087893899c0207bece8e385ac77eb0ee923d23d43b2cd431dcbad7766e12aa578572c93c73a43168d1a142a9538283436c889512380cd9668c953a08a64eb98

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-493223053-2004649691-1575712786-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      38bb6f027c7c2ce7b7bf4700047dddd8

      SHA1

      14224c83d221cb5618d275267577c27b44e54f38

      SHA256

      becd3ddce773f713a977c97079ecc3c46451fb8d60fe4fef8b5da471d2e886e0

      SHA512

      d2add1d6d88fac7402ad9c188aad66065a348ef092ed46ef1762bff9b6bd9c055fbe5b59fb1936e85ae6e1510fb6db03ad55d301a6485670f04cb356ffeb11d0

      Download Submit

    • memory/644-1-0x0000000002860000-0x0000000002870000-memory.dmp

      Filesize

      64KB

      Download

    • memory/644-2-0x0000000002860000-0x0000000002870000-memory.dmp

      Filesize

      64KB

      Download

    • memory/644-2813-0x0000000002860000-0x0000000002870000-memory.dmp

      Filesize

      64KB

      Download

    • memory/644-2812-0x0000000002860000-0x0000000002870000-memory.dmp

      Filesize

      64KB

      Download

    • memory/644-2811-0x0000000002860000-0x0000000002870000-memory.dmp

      Filesize

      64KB

      Download

    • memory/644-0-0x0000000002860000-0x0000000002870000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3508-2831-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3508-2833-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3508-2832-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3508-2862-0x00007FFB44180000-0x00007FFB44190000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3508-2863-0x00007FFB44180000-0x00007FFB44190000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3508-2830-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3508-2829-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

      Filesize

      64KB

      Download