Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-12-2024 06:26
Behavioral task
behavioral1
Sample
2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe
-
Size
153KB
-
MD5
61ffbe6fc8897d4a6211d228a6f2f15e
-
SHA1
2f9bc7b18a9ddd67b96b5c14485ea0da76d13bcb
-
SHA256
505aebf78a04697109439d5486784f398e8c5d25a378eda3a8468898717117a5
-
SHA512
a2cd477e31760b815c8296b4749cfa02ec1b9f61b46f475a5a175266a787fd8f16fde67fbd3d45f8d153b6c7345399c3678ef9ae4a202187cdb490a427e4d91d
-
SSDEEP
3072:MqJogYkcSNm9V7DMVYXQ/IfjRJ5JFF0CcT:Mq2kc4m9tDMVKQep
Malware Config
Extracted
C:\BDCseIyDm.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\BDCseIyDm.bmp" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\BDCseIyDm.bmp" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\International 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BDCseIyDm 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BDCseIyDm\DefaultIcon\ = "C:\\ProgramData\\BDCseIyDm.ico" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.BDCseIyDm 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.BDCseIyDm\ = "BDCseIyDm" 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BDCseIyDm\DefaultIcon 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeBackupPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeDebugPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: 36 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeImpersonatePrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeIncBasePriorityPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeIncreaseQuotaPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: 33 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeManageVolumePrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeProfSingleProcessPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeRestorePrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeSecurityPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeSystemProfilePrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeTakeOwnershipPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeShutdownPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe Token: SeDebugPrivilege 2912 2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-05_61ffbe6fc8897d4a6211d228a6f2f15e_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5add5a6821dc1ab817360a8bccce6092c
SHA15e38e4cea5932b809adbcfe3c83d87b50d2a806f
SHA2568d96eb4732f9244f6a4f894c3fa6b2f9cbf982af1e9e9658e9bb3918a838e2d5
SHA5127f094b931747485cd8a9bc45fac79a9df0bacbc6e43c3f85071ae1c190ceb916e122a128c891c9832a18a2f049fafb879dc45645f22499aba84e66a3723d7a13
-
Filesize
6KB
MD56153535503bb0ebbcc03b09bb3669d40
SHA1efb9e859d22ce9808b44e53351b2e999da82bfeb
SHA2568978567cddd19fa5a7209aacd107210d12f7c46bd0c0484bc4e5fec43d461b3d
SHA5123fc548e4c129e8205592f43ef229e9ca142698a9847eb5ec170b776c76a77410f4ed4cc00a9b3e5b81760e2896e22ea3b04346f95d2e8b0345537dc6a3a3ae93
-
Filesize
129B
MD567cde56ed906e4598a70c26455d477a0
SHA145817dde7860f246edcc376c45f5425d5c4de7ea
SHA256dfdf8417708b96476a9de7ab1fc45292edfbffcadcf5e2b8f1089e80452a0df1
SHA51210d292a84131fbd7449bed51a0ec9d0a4737f88f0046509908ef4b3717e17319c0de2f1c7292f537811a522c43779d003533b2b62a25b4e6355ac902a69146ed