Overview

overview

10

Static

static

10

2024-10-24...de.exe

windows7-x64

10

2024-10-24...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-10-2024 06:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-24_4921f3ca5e8a3691addfaf0c7acfaf00_darkside.exe

  • Size

    148KB

  • MD5

    4921f3ca5e8a3691addfaf0c7acfaf00

  • SHA1

    81a019c4133250928ad75f2e8354db53617774fd

  • SHA256

    2a56f0480714990649d74849e94e706d813f750ff1331522637c46c82576e116

  • SHA512

    2bead5561dd864fee7a8805d8be4587a6906818836b4c858e94d3988ed4202fa424d1eceafaf5f6737da8e22e1654133ea976d730586cc848f464dca0c814e5a

  • SSDEEP

    3072:66glyuxE4GsUPnliByocWep9l9xcFRtSF8jS00i:66gDBGpvEByocWeDARO8+

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\tDHz9YpfM.README.txt

Ransom Note
******************************************************************************************** ************************ Your data are stolen and encrypted **************************** 1. How to contact? * 1. You can use tox: https://qtox.github.io/ send message to us. Tox ID : 465928E63E40E772C89D47543523651AA761E5CC0599ED43C0D6E3AE1EFB9A01C14457E1F32D * 2. You can send email to us, Email address : [email protected] Suggestion : Contact us in two ways at the same time, if you haven't received a reply to your email, please check your spam folder. 2. How to pay? * Contact us. 3. What guarantees that we will not deceive you? * We are not a politically motivated group and we do not need anything other than your money If you pay, we will provide you the programs for decryption and we will delete your data. * If we do not give you decrypters or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. * We attack the hundreds of companies and there is no dissatisfied victim after payment. 4. What happens if you do not pay? * If you don't pay, the data will be sold on auction platform after 72 hours, data will be bought by your competitors, and we will report your company fail to protect data as a result of a data breach to the data protection authority in your country, you could face significant fines. * Do not hesitate for a long time, the sooner pay, the sooner your company will be safe. * If you pay, we will delete data immediately, we can also provide you an paid hacking services. You can pay for the services after the hacking is successful. Please trust our strength. 5. Warning! * Do not DELETE or MODIFY any files, it can lead to recovery problems! * If you do not pay the ransom we will attack your company repeatedly again! *** Your DECRYPTION ID: B3AC0D0635338D1062025F2E25336730 ************************ Your data are stolen and encrypted ************************** ******************************************************************************************
URLs

https://qtox.github.io/

Signatures

  • Renames multiple (626) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-24_4921f3ca5e8a3691addfaf0c7acfaf00_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-24_4921f3ca5e8a3691addfaf0c7acfaf00_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:1292
    • C:\ProgramData\F4B1.tmp
      "C:\ProgramData\F4B1.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F4B1.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4512
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:4488
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:32
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{53F7ACD7-4059-481D-8880-5B394D1423E1}.xps" 133742325645420000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:4288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\CCCCCCCCCCC
      Filesize

      129B

      MD5

      498e2c91c9f6d04d59fef9781dee64cf

      SHA1

      b1ea3b2bb18868f0c661be20849752f6926ef485

      SHA256

      44a1801e0f104c017bde325e672161f323a9d4ebdc32ceabe943e93b96b781dd

      SHA512

      4476a0f5730ec9abf99442bef3fff172be02e95c65d135ec96c816e573c86929df1cc45f1e29a4ecbe33b8a69463b507db9ecac306a1db31ef6e1ec7c23f9057

      Download Submit

    • C:\ProgramData\F4B1.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      148KB

      MD5

      d29993620fd8ab9df78305e711d6ffa2

      SHA1

      1283477b940dacd64af2d9e91ef74d8eb9df9a4e

      SHA256

      4ee06ba2c6f66c96812044dfd0742e3f492130e14519d68c78d968880c6dd0a1

      SHA512

      6277463bd887a1ae88590718999fb646e9a79552f5f6b04c0e5f11336eba20a2e45d5f41f96b7280c965602830ea1f6fb43f031820ed3a6d8bf3424b5a676fa3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{86AE4AF1-8E65-4C8E-9743-743EA98F9F10}
      Filesize

      4KB

      MD5

      6926d3319387bff729860768fb456532

      SHA1

      1b89edef3822c1b6c381c449adc4483417209b71

      SHA256

      3000f2b0e195aab57ccede39188f3083b20d76409639f308d8c24d39a34ff41d

      SHA512

      178789a705fbbe92f711e8ab60bfcc20ae6cf258d3bcffee7f9fb70fbbcfe9163b49424026f572cb52439acaf9a3b283ee698b73c54737bd0c52647954eeaa7d

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      18e11e0f6737e0f9d0395a828e15cb1c

      SHA1

      67ef4c0dd3367803ec1d8b2e799272108f132001

      SHA256

      17d37b4687a822495a4783ee58eb81a632dbed221ba16713f80f87931b5158af

      SHA512

      c724cbddee70eb1330017c834594859dd992a3236973ec71b1fbf8c0ed3a9e6b636f9b0eee35ce68cfb4446435afe464bb909f2525d2ba82739b364eac63c8f1

      Download Submit

    • C:\tDHz9YpfM.README.txt
      Filesize

      2KB

      MD5

      741f86220787fb23c6f8f6385dd9f5d9

      SHA1

      c0d9a4e25daef89f5f770a2d722bbed0fe436b6a

      SHA256

      8c18a3a6eed09788496677f5997f6c5818f4ba6caed0a0301c6549aefa10f4a6

      SHA512

      d56e8ea36241e523d0b8d8e15b70dfdc0a07047d86ea6e6f8a43b253e1f50673d2ae28098602b9f51b7f38cc6a68c60a41f3e2887d350ad319ec16acc1d4c01f

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-493223053-2004649691-1575712786-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      cecb6e56c17b955e7d6c08ff2e77de6b

      SHA1

      53b0ee4e9e123bd962f0616026992a103ba7f849

      SHA256

      ac0823ed4e4cac224a731ea898324c35c27879d4fc01b85bc9e0aba61ad13c2a

      SHA512

      ab4c766ea664846d3296434e41f98319f51839b24c615f5a6ce653a576f44770bf15b3aa39f86bc259814b19d4f8252bfc8f7310701fe30551282e1512e29907

      Download Submit

    • memory/1232-1-0x0000000002980000-0x0000000002990000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1232-2966-0x0000000002980000-0x0000000002990000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1232-2967-0x0000000002980000-0x0000000002990000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1232-0-0x0000000002980000-0x0000000002990000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4288-2986-0x00007FF834450000-0x00007FF834460000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4288-3016-0x00007FF8323F0000-0x00007FF832400000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4288-2984-0x00007FF834450000-0x00007FF834460000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4288-3017-0x00007FF8323F0000-0x00007FF832400000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4288-2982-0x00007FF834450000-0x00007FF834460000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4288-2985-0x00007FF834450000-0x00007FF834460000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4288-2987-0x00007FF834450000-0x00007FF834460000-memory.dmp

      Filesize

      64KB

      Download