Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 09:55
General
-
Target
2024-10-12_a366442a9d5553ce1143c7b4fd6454d6_darkside.exe
-
Size
153KB
-
MD5
a366442a9d5553ce1143c7b4fd6454d6
-
SHA1
d33b8d01b0869bad80a15d534bdb89e3c5b71520
-
SHA256
497879e5d98ffd4abc0408a997f754f30cc21043d9aa794b0da2878d22653904
-
SHA512
a5db076cb3e37209a4d7443d5f90582753ccfa3b4380efa552a99a40dea4c6e0ffb3fef7795da5f0f50c55731cef296607bdbbafae8ac9bb45fed9a1091f6598
-
SSDEEP
3072:G6glyuxE4GsUPnliByocWepMrGhNpf6+erXFzNHG3g:G6gDBGpvEByocWe7hNpo5
Malware Config
Extracted
C:\xX6BQRYHV.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (622) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_a366442a9d5553ce1143c7b4fd6454d6_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_a366442a9d5553ce1143c7b4fd6454d6_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\AF2D.tmp"C:\ProgramData\AF2D.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AF2D.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{23A6D1A2-2C2C-4648-9888-5F7281404AA4}.xps" 1337320052757500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD58bf26b66515397f0694b2d187cfdead8
SHA15d19818c619792cce61c6c518fcffcbb58a4618f
SHA256582c9984d955378ec3d813f452ed1b0c3fb92f27e2bb0115a5b5b7cf39a516c4
SHA51211497f986bea5eca3ef19ead49d576cd180222ab63749073c21853b6c8e9be5d4506dc794327aef1dfa442cbf0061f55e96f106bdafe796f139b86e80570f155
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD5fc2fc526bd351993e5e14137426272ec
SHA1cce9b09294f386db05cc11ba4071193b139f923c
SHA256e152d3edb273c10bf106b8ec7756f688e1a81a780cf4b3aaa36daf7a29a647eb
SHA51201553a7d748c6df99d7993243985efaf92f2e901dd55cccd36dd5ebf998f792db35e2711b0c7ebb667209eb7e312d6aef4384e68a2b0e0f27818acd7d8f7cbaf
-
Filesize
4KB
MD51d76f83982029e883f0bf3214df4ea1a
SHA1f03cf0556c68ca89001a5d2efb61b04732d0b841
SHA256e685f6e89b8818921c3a6b7f6a8ab34c0c914aee90a3006641a98878e6f98608
SHA512f29ffd025b8f1344629ed91cbb278a99e9ed84ca4809a55f3ec67158082f7b1a8bcb333ec5a87b948f7a63a01a8c4351d0ee201feb762f34d288acec4e8ae7dc
-
Filesize
6KB
MD5c26398dbd7ac27d5bf82f284550f3ca9
SHA16aa523d0e41aa9c29095f2c865fbee1500dd2a57
SHA256970a47d9bd616163085bb55a33f60a54354684652e51d0daf9206cb1c7c299f4
SHA512ced8997a17ba3c7346e9090d2fbae0ea516298057bc7e3552fb0e1241697921b3cd9d38bccd122f37fec9f4921c2b2ceb2180e54a453804aba786767b34a38a1
-
Filesize
129B
MD57974dd8718775c8a5b71f41c7b81c6f1
SHA1d5b23c8128f3f243e356288f0918a1eb9d496e04
SHA256b99ad91a15577a7853e09236b09018e2e6a1d751bac02d296e0e6a909ea1ba9f
SHA512bf40e69197f12d6aaf4cbb268e8840e9553f93cb6d51559251184a89923f8960a5b04fe1a029957bf3476dd66cb120ba8a897e4569f728a8499f7d4d6f546d35
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB