Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-11-2024 02:41
General
-
Target
2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe
-
Size
154KB
-
MD5
ced213eebfccc988689c1bb64464ffbd
-
SHA1
92b2447cc03f20e20fb84e0eeb0a124d5088b5ea
-
SHA256
154d1ff5a5cbf6a3eef035232182a77d28c6fc3577d1b1e1c8d93a7f40114392
-
SHA512
9539d17dd916e94528c51f2c092179bc5a2f8bc9ecea52fc7c8ebeab3e7fedd253bef9a76b27b974d1f8b294157368d5041329ae33ca764149bc14bd6018e483
-
SSDEEP
3072:P6glyuxE4GsUPnliByocWepKPGdEGSyzRcq+:P6gDBGpvEByocWe8PFyG
Malware Config
Extracted
C:\KGYxjHxbi.README.txt
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Renames multiple (617) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-09_ced213eebfccc988689c1bb64464ffbd_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\E408.tmp"C:\ProgramData\E408.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E408.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{E24BE056-5DDD-4BFA-AD07-EEAA57ECD319}.xps" 1337559370438200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD56d06311db153c14a4c850d29288b4317
SHA10f01ddc82b667b918c44524519607822f297dca0
SHA25685a63a7b2f83bbcaa25984e810885cf868bb52fcbd64290b5306ba7d21786248
SHA512363ad2c060c8efa7bd76b315987ca93e6468e9de829e555ae606b8f37bbecbab9cfb22f2a87abba84ddb13820c64504339ce95f882ea9f34e2b6648865839818
-
Filesize
6KB
MD5154f3bff3a4dd1a99bb3db81f7e6439c
SHA18d335ac1f3bd91d0df0fac05df2a978bbd969a0d
SHA256baf9c533562e5e082be2c4c088d7a29ad196c682bb0a92586912cec9cf01ef93
SHA5129877d7ceba9f3f3b1b3bb9d373fb51aeecf491093771c1aa9bd060fd417c3cc61defe38ce64afe0b0b0568365280cb26e09c2646dd59bc2d8ee8222a14df6add
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
154KB
MD5ac1046c18a98aa08612052d2258e00a6
SHA17f05da660160b76cd4b1f2909bec0aa102620f4b
SHA2564d17477b7ca826b3d5cf2d62eef81278809a9e5400b84c90fdcda14269063c38
SHA512eff75e35fb767b301082eca7054745bd6284ad49aa3ffac57eba47b70a7fca1fd181ed8dcd49b84b8466a7a04390dbe08367b8c0994802fdaa2c85ef585071a4
-
Filesize
4KB
MD52367cce81582477f2edad7d876645ef4
SHA158277e9d31fd95b82c492d900be645ae4f68438a
SHA256fc2263c8334d5c4452ab554f6a57c763597d12eaae8234068b7061b2a3c1a4bb
SHA512ec0a3aa6f24c911e69da0670a519cef4a2ce17d105bb66286067b593d5b71cadfb4d826313daef4f2744de7ce5404b4d3c8ed62a49791646ffe0958921157394
-
Filesize
4KB
MD5d12c7a65af271d663272bca651b25ef5
SHA1deaa93b371f85a85f2c86503abdf61ffa6065fe9
SHA256b6fcb45bc71a5338181bc115c05d76ea723aa3cfe60c16a662da5b44ff963ab2
SHA5123cdb8d03c29011fe446b15000778c5a296b6f48ed7bdb264e6417fe2ee96af3e5ceb207db3ce83481ba6b2735a8f6fe1ea0444a77f3909f2a7eec2845ec97e04
-
Filesize
24KB
MD51f23d6fe2f17ec87291c02d455f44e3a
SHA1af522cf98d25baa2dc92a22991bb08b828aecea7
SHA256190a795fbf9e2dbd9cf6f7975712f1ed582cc6178032aed2456466a14b3eaf8a
SHA5122f5070837bcf873dae322597f0fcc0210ea463d1e63bd3e9113eda54588e47829ed3b0d18dd5d2fcfa604bcc5a24037ece770e4dc045e9d16400c21cf56b2822
-
Filesize
129B
MD527b84425b936c9bc163dc892595503ed
SHA1ea55e4f5e43007d96f69487f04dfb5e5e6b0df9f
SHA256ca06af0a3b5225818988174b0bae936026f84105a86aa67858c74b262c7b240f
SHA512152b6ef442194fd95c782eba22f8f3ba6d9b09e7edf2f1c3d58a51ac2a0c0859452357ce8baf6c5ab8bf0129ad1b90dd2960e1b830ecc2cdbecac7b489a0e55a
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
