Analysis
-
max time kernel
147s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 01:18
General
-
Target
2024-10-16_2735464496f521f06ba2956555ab5b37_darkside.exe
-
Size
153KB
-
MD5
2735464496f521f06ba2956555ab5b37
-
SHA1
49db801d6069fc9a162c0a030a898143ec6a376f
-
SHA256
aeb147f86c7ef8e7f81ba4d78726f72163d57ca0f2a647f2c8df633102ac6be9
-
SHA512
5bfef6b08ae3d3ea46c218de1b98c1661ee11720b3cdf814177fa28edfae79543e4e5e11a65524345e012408c94bc2ae993a07041f0c6fef4009b4fdef8ec8a4
-
SSDEEP
3072:H6glyuxE4GsUPnliByocWep7skqlpthaf6MicZf:H6gDBGpvEByocWedqVEyMi6
Malware Config
Extracted
C:\PxX4f7FMU.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-16_2735464496f521f06ba2956555ab5b37_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-16_2735464496f521f06ba2956555ab5b37_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\DB2E.tmp"C:\ProgramData\DB2E.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DB2E.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{7B121ABD-4719-48E7-9CE0-CEADF65AD5C9}.xps" 1337351511119600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD591d40f169a9fd91865191a129aa80654
SHA1900a2e7a76c0f0f431f5ce6d9cbc4576b6e4d2e3
SHA256c6f7706e15108ffe89c2f27ced9203209681e0b47056c81eb9bab7de3989c644
SHA512e2f26adbc59c9b607b0ec79a7c475cded25c980778b4cc32ff1ced8e0821d06eeed2b129839eddc872acd1e0534772b56ced5dc64251e53cce1362a121456e36
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
6KB
MD5b66ebd0c8bc660a368d98ce4051355f8
SHA1f5d7039df32fe7883cb52a09de6a5fb37dcbc63d
SHA2565fbc0a2200a9537ecf4429f66a4be7790fbb35aac7acf02ed7f98d2fc49822e4
SHA512e1045631455da1757f2f1bbbf80829a24840cb38c44cceaea864ee74280979e5419404a9177ccd8bba27fbdf6141958f3b63c592814f3d1cb6aa74506a8fd1e4
-
Filesize
153KB
MD5990f51f8f4da10921bfcd3ed73b006a5
SHA1e794d499256f7f5c8eb44af9a55dd37eba813e5f
SHA256e2361efad760f4f8179591d21544e03976a567e160b760f67ba390fb6527368f
SHA5120fe6ee85ec79f010316ccde9586f94c1e9a8d6241b95745e9e95a1b8162180090a8687644ad1c666bbacaf0934f061b67471800184e990bb2013ebef56354fb8
-
Filesize
4KB
MD508d2c2369f96b58d47f5e7b0f76cfeae
SHA148bb7e1515b13867317ce5da15a043fb3e6b2406
SHA256744189416c3af020b0b0a83a30ff208c6bd06ae313a8f8f646c59acb1015cf85
SHA512509647956f824d067e72a6a3403ee29dc87e3e61ced3f4ffd18409738b9ae46a75dffa970a944b6708901777022c4e6073373d823a3333094a056a919568fbe8
-
Filesize
129B
MD5c81ca04fc263354a24b7769b028b4a9c
SHA1755826077fffaf47b24cf6c3a45f33c3a7465d3e
SHA2564bbb99b869b0629e1f44ec345a570906d35e22919b0ca8cad127960a2898d912
SHA5126947845f22bc09c7d3f314a46a650794b0b9679dcfe700ce2e14334072964a556b8dc778956df72e2781b75a63fe7dbc744f46dd7f1adfbc2747f865fd5f1fd0
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB