Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
05-12-2024 06:22
Behavioral task
behavioral1
Sample
2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe
-
Size
153KB
-
MD5
61ffbe6fc8897d4a6211d228a6f2f15e
-
SHA1
2f9bc7b18a9ddd67b96b5c14485ea0da76d13bcb
-
SHA256
505aebf78a04697109439d5486784f398e8c5d25a378eda3a8468898717117a5
-
SHA512
a2cd477e31760b815c8296b4749cfa02ec1b9f61b46f475a5a175266a787fd8f16fde67fbd3d45f8d153b6c7345399c3678ef9ae4a202187cdb490a427e4d91d
-
SSDEEP
3072:MqJogYkcSNm9V7DMVYXQ/IfjRJ5JFF0CcT:Mq2kc4m9tDMVKQep
Malware Config
Extracted
C:\BDCseIyDm.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\BDCseIyDm.bmp" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\BDCseIyDm.bmp" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Modifies Control Panel 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BDCseIyDm 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BDCseIyDm\DefaultIcon\ = "C:\\ProgramData\\BDCseIyDm.ico" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.BDCseIyDm 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.BDCseIyDm\ = "BDCseIyDm" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BDCseIyDm\DefaultIcon 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeBackupPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeDebugPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: 36 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeImpersonatePrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeIncBasePriorityPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeIncreaseQuotaPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: 33 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeManageVolumePrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeProfSingleProcessPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeRestorePrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeSecurityPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeSystemProfilePrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeTakeOwnershipPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeShutdownPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeDebugPrivilege 2244 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD56ab00c9f0732433b383dba914b011647
SHA17f7028f2b1bc6a69283e4f14010f594eecf3b9c1
SHA2564f7634797e5a42bbb7699f99b7f825ca51e519c6289fd3255dbe3cace8228fba
SHA5126f90e796c7bbd7cbe374bcd583f1d6c0e7b551acdd5926066bfe135e9ea6debe907c4dd8fcec4ac1e900617f5565eec59f714040c9c25f336b9707cb2223946b
-
Filesize
6KB
MD5a52e89054ae41e6f452b68d707645caf
SHA19bfb2483d3d438494b58005292cda54d2dfaba14
SHA25672d42bf14c22f2f9aaaddc6a32a6c34a47299c83f6c2bbf514a1b9d18b5c3a1a
SHA512a5de4cf31f3c3329cc77fc30d44183e1abe82b56c4f5c7d5c28a81fedeef21bfc855165e56d04dc8c78d4be6b1ee6ea9400cf45f799271723d4a691067d74d79
-
Filesize
129B
MD5f910693c4d032ce60994a52fb77f971f
SHA1ee03da75dcec4e5d1a4c49fe6839923ba4e72c86
SHA2561fdccac856a488ba58229b622b57f299adc6e130c88d7f87407d109b05e60c6f
SHA512118eaab9a668b372e3c27c6cc01abd78cf3a90f5721a262284e2c4cce409f131fa0c6b7a71240070296a43dbbeaac60e830d94c69010bfd1f7727b44318da76f