Overview

overview

10

Static

static

10

2024-11-04...de.exe

windows7-x64

9

2024-11-04...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-11-2024 03:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-04_a925cd24c02dd75fb48c6db87ee43f46_darkside.exe

  • Size

    144KB

  • MD5

    a925cd24c02dd75fb48c6db87ee43f46

  • SHA1

    4c6d15029d1457d011f89b21fc0c61157b13a3b3

  • SHA256

    acff52603661d22885a36c7114be3278aaeecdf06d47ab554fc4173979aa2baf

  • SHA512

    ab4e75139badef3533bff0ea7ca545a11f3833c82bb30e3abaa27841b296962773e745dd96111c06b0a0caac63d16ee41630b0f192c0a3f6187d00e81e81c77f

  • SSDEEP

    3072:IqJogYkcSNm9V7DRrTLdNF+qjFe0qtHWT:Iq2kc4m9tDRZNFDjFed

Score
9/10
discoveryransomware

Malware Config

Signatures

  • Renames multiple (5333) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 42 IoCs
  • Drops desktop.ini file(s) 53 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-04_a925cd24c02dd75fb48c6db87ee43f46_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-04_a925cd24c02dd75fb48c6db87ee43f46_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini
    Filesize

    129B

    MD5

    d83a667443aeeb0ba7d2a4e3837c4cce

    SHA1

    488980177a5d490cd9ae17355628cf8d74b7788f

    SHA256

    0f25b555054184b5556b5be4816c90a0a239bfddca24b61fef33715f79d2d709

    SHA512

    b33900f2d6a92db0f6faa4f3a6b94bb7c5f44ef680be1cab22e61c09e712d5709292f6ddd13d6230e1774dee510805bea614fa5651ae4ee6ec231d3e76fcb437

    Download Submit

  • C:\Q9dvwfMde.README.txt
    Filesize

    65B

    MD5

    2a48a53c88625db8633b6e215c56aa19

    SHA1

    360c270064c95eb317bc1441309838c595729fa3

    SHA256

    4bc9a92ffdd57b151922361f143a06bc49139dfc0f6074b3628c3d40207ca393

    SHA512

    1f7281bf85e4be0540156d32e3027d9c61eb237a6febfbfad3f6f7f7bd8d00492933de436a25db8e82c56cfd0c97667c32b9fabd4904ca929f2c0b6618f8fab9

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    ee8615ab279ee3e4ed04226e47142f99

    SHA1

    5f6033bdadaec4d9871cc8f17796731942939c5b

    SHA256

    ed24d9244c30e77b394fe314603d155d2773e3b1a5da2bbe657a049f4e3b6be3

    SHA512

    66c5dfb614477537a8b86779f41b760e4e4909303306ebf54152612c613a5d1217461eef4b3995c7afb1039ed22c9d59f0f4b0bea0f6d80c56d63d2c1ecc01aa

    Download Submit

  • \Windows\SysWOW64\bcryptprimitives.dll
    Filesize

    243KB

    MD5

    e8449fe262d7406bcb2ac2a45c53ec5f

    SHA1

    f76bb1b4d0ad47f68f8381281f87839304c252ea

    SHA256

    6c118c9fb26404d1943824cf3990f36e12986547ffacb7cc0df975a913065d78

    SHA512

    94c6fd6f3945161b86bf4ce703e8324ad6514f058fe1a859dd89a39c923fb0dff461aba65c737938e48d834b29156e7fcdcc4c24207a2a3146aa78fbabe79caf

    Download Submit

  • \Windows\System32\RstrtMgr.dll
    Filesize

    184KB

    MD5

    a7d4e2c269301bea243676ed56f8b4ff

    SHA1

    a78533aac1856842a3a98eb9d1aa3957716ecfa4

    SHA256

    1a86feaa2da6fcf8f0011a4b4a5dcb722bff03f3b29c9fc4d25a2b0f621e9416

    SHA512

    cfe26c84885e7ca9f9238a3646f9c331d7ad7940d1e377a48cf1d450b6fac08ca02053127028b03c8f37abb1f47201149dbbdcbf62b5ed11e0dde130e00a3a32

    Download Submit

  • \Windows\System32\es.dll
    Filesize

    393KB

    MD5

    4166f82be4d24938977dd1746be9b8a0

    SHA1

    5174036d781677f5444d9a23079baf18f4bbda44

    SHA256

    24121751b7306225ad1c808442d7b030def377e9316aa0a3c5c7460e87317881

    SHA512

    df60546a7b76fdfb47b963e109367d48a197744d468e96b9596ccde6e90ef01537a7147863b9d63ca7580b76d72a7570287d151711c2b2618f4f938df96af99e

    Download Submit

  • \Windows\System32\svchost.exe
    Filesize

    26KB

    MD5

    c78655bc80301d76ed4fef1c1ea40a7d

    SHA1

    619652b42afe5fb0e3719d7aeda7a5494ab193e8

    SHA256

    93b2ed4004ed5f7f3039dd7ecbd22c7e4e24b6373b4d9ef8d6e45a179b13a5e8

    SHA512

    ebc9242cd81cf493e7b0358b32f9e658e10b68a3df6122e5ff1cba22020404758ba7514fa0a54ead090aa10af4d2c21ebb153a70a62a63519b69b5a133011bcd

    Download Submit

  • memory/876-0-0x0000000000DC0000-0x0000000000E00000-memory.dmp

    Filesize

    256KB

    Download