Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-10-2024 09:51
General
-
Target
2024-10-12_a366442a9d5553ce1143c7b4fd6454d6_darkside.exe
-
Size
153KB
-
MD5
a366442a9d5553ce1143c7b4fd6454d6
-
SHA1
d33b8d01b0869bad80a15d534bdb89e3c5b71520
-
SHA256
497879e5d98ffd4abc0408a997f754f30cc21043d9aa794b0da2878d22653904
-
SHA512
a5db076cb3e37209a4d7443d5f90582753ccfa3b4380efa552a99a40dea4c6e0ffb3fef7795da5f0f50c55731cef296607bdbbafae8ac9bb45fed9a1091f6598
-
SSDEEP
3072:G6glyuxE4GsUPnliByocWepMrGhNpf6+erXFzNHG3g:G6gDBGpvEByocWe7hNpo5
Malware Config
Extracted
C:\xX6BQRYHV.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (306) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_a366442a9d5553ce1143c7b4fd6454d6_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_a366442a9d5553ce1143c7b4fd6454d6_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\41E0.tmp"C:\ProgramData\41E0.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\41E0.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5388bf7f50422aade61a0f764b5f598e0
SHA1299a59d9ac115d349e47980ebbc98496f86daf7d
SHA2568bce2ccf5252447e8c27d995da16cdab090a10058b0f334a37dec5a43efa7b36
SHA5127dbe1d64d9e7a0b4b78336b03e424f5617d16be96e3feaaf1d1fb4748f0e61862060ce8e337b741c3ab0356db2c820dc3c5b446361d664328c84f9a610f6ad0c
-
Filesize
153KB
MD5457db274b2b9d76dd3daf3a68ecfb99d
SHA1531e5dae5ed9a4824aa534a1267e5e763af7a450
SHA256594b1c1dd1b98f1de5501e0eea1f60ede981fb1f6a201315c00e08c26a17c03f
SHA5128c4d137f9b94827dfe0da641c92b568359382894b7fa81b7bb10755b2fc7c7b96088c49476cf1a2602e3e4a3d21a96f097164085e9cdf03391139ce3f0f5270e
-
Filesize
6KB
MD57fe13f2ab1014f036ab9368077f79fd6
SHA10bd88d7c0799fb7a5c00ce7a29dda64334767e27
SHA256f6dc5473ae6c31bb5672a3ad341be07e9426986eeb6d39cf85c8281841b4dcf7
SHA512e54900cb06af021ffb869e183846a4ccc6b7309196256b3ec93a7d924334e2ef6cca1d60effe6e5b474d977a432171cc6fa7801e40e5a7aafc34777042cca6d3
-
Filesize
129B
MD594ece00cf44b45ff6060ef5fd18d0aae
SHA14bff12c41a643044021ae6bb680cb41033a3ec10
SHA2568fc072c9f6cdcc8960fb565573acd95b53149033293651c4208c6243e0f39e9b
SHA512a46f71567cbf10084910c3fc9e2125f1b3af4ae9f40b59c094382ed77fec79633d66b00ade3d50c564f222e5caf62b63a0885d38b756436ff13bb22e26d66a3d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB