929e439102d8a4a1c95953dee94ef7d9c052f760f2a900f3d63eeb9ad626c77d | Triage

Sharing

General

Target

2024-11-26_0065be548654ead0e1f7c4dee20d48c6_darkgate_ransomlock
Size

436KB
Sample

241126-bt69sswray
MD5

0065be548654ead0e1f7c4dee20d48c6
SHA1

c07923bd2340fcf31ca478e13641776c1fc41db6
SHA256

929e439102d8a4a1c95953dee94ef7d9c052f760f2a900f3d63eeb9ad626c77d
SHA512

93853fc060384238ea8d2aa7e2d2d55b83fdeaffcd211189dd063ef232af60735fd5bd17eb19d78de16c5f27318e4053bff38d1941481fec1cae3a4fa6476b7e
SSDEEP

12288:7MSU4joci8M6PW1GVFeFd60DFUyhecYM:ASUCpM2W1Gvgmyecv

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  2024-11-26_0065be548654ead0e1f7c4dee20d48c6_darkgate_ransomlock
- Size
  
  436KB
- MD5
  
  0065be548654ead0e1f7c4dee20d48c6
- SHA1
  
  c07923bd2340fcf31ca478e13641776c1fc41db6
- SHA256
  
  929e439102d8a4a1c95953dee94ef7d9c052f760f2a900f3d63eeb9ad626c77d
- SHA512
  
  93853fc060384238ea8d2aa7e2d2d55b83fdeaffcd211189dd063ef232af60735fd5bd17eb19d78de16c5f27318e4053bff38d1941481fec1cae3a4fa6476b7e
- SSDEEP
  
  12288:7MSU4joci8M6PW1GVFeFd60DFUyhecYM:ASUCpM2W1Gvgmyecv
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence