Overview

overview

10

Static

static

10

2024-12-13...de.exe

windows7-x64

10

2024-12-13...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 01:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-13_107d3c9b830ddd884f3ca5761e777f9b_darkside.exe

  • Size

    148KB

  • MD5

    107d3c9b830ddd884f3ca5761e777f9b

  • SHA1

    36c6830e16f46d00e16431175b31f3565aa5b4c8

  • SHA256

    bc20b30abf15d6374ef9094a49f0875b53c154a0fcb3ae6e054d678091208f70

  • SHA512

    7a061b642955fc1775e0cec5b4f4deef4e22ad0ceeed4b15c948c3f1fbf42c166554c71212a3c874b8a0177a255f1da6b64af4225d0de99e7d87ccd598c3ecb3

  • SSDEEP

    3072:46glyuxE4GsUPnliByocWepCnkOry1yC8Nwt:46gDBGpvEByocWeSkOmC

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\8gduxxdQN.README.txt

Ransom Note
Ni hao! Your data are stolen and encrypted. In case of nonpayment - all information will be sold or made publicly accessible, and we will also continue to attack your servers. Compared to other ransomware we charge a lot less, so don't be stingy!:-) If you pay - we will provide you with decryption software and remove your data from our servers. We will also let you know about the vulnerability in your servers that we used to infiltrate your network. WARNING! Do not delete or modify any files, it can lead to recovery problems! You can contact us using Session messenger without registration and sms https://getsession.org/download My Session ID: 05839c6cce78c3f3043e7a65c27e881cbb9efbda3bab942d273a496876340b254f You also can contact us using Tox messenger without registration and SMS https://tox.chat/download.html My Tox ID: BF2FBB22C4CFD24EF9AFE2CAB694D8C1E3E2340393E846514659C59D8C52F43CBD76209603AE You can send us any 1 file for free decryption. Good luck! 您好！ 您的数据已被窃取并加密。 如果不付款，所有信息将被出售或公开，我们将继续攻击您的服务器。 与其他勒索软件相比，我们的收费要低得多，所以不要小气！ 如果您付款，我们将为您提供解密软件，并从我们的服务器上删除您的数据。 我们还会让你知道我们利用你服务器上的漏洞来渗透你的网络。 警告：请勿删除或修改任何文件，否则可能导致恢复问题！ 您可以使用无需注册的会话信使和短信 https://getsession.org/download 与我们联系。 我的会话 ID: 05839c6cce78c3f3043e7a65c27e881cbb9efbda3bab942d273a496876340b254f 您也可以使用 Tox 使者（无需注册）和 SMS https://tox.chat/download.html 与我们联系。 我的 ID: BF2FBB22C4C4CFD24EF9AF9AFE2CAB694D8C1E3E2340393E846514659C59C59D8C52F43CBD76209603AE 您可以将任意 1 个文件发送给我们进行免费转录。 祝您好运
URLs

https://getsession.org/download

https://tox.chat/download.html

Signatures

  • Renames multiple (8026) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-13_107d3c9b830ddd884f3ca5761e777f9b_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-13_107d3c9b830ddd884f3ca5761e777f9b_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\ProgramData\FD81.tmp
      "C:\ProgramData\FD81.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FD81.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2888
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:2024

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      2a35123ee73ddad67f30e06f0116d1ff

      SHA1

      c09c87a395e43cc4f8b1cd67f29b53de0c458c9b

      SHA256

      96f07420985658ecd6c4051150cf8c4defc6e637eee10d476f0915d5c17bead8

      SHA512

      233153d09ea869adfb53254df3796085e966f6dd7e5476ca8836b0a18d287a297ccf021626a4f00b8a4a8d95de615938d324311e87951e4027d65958f2f95fc9

      Download Submit

    • C:\8gduxxdQN.README.txt
      Filesize

      2KB

      MD5

      d16734b43544f0e05d570563c001e4eb

      SHA1

      73cef7171e473b7ebbec10511baa694ba51d38ae

      SHA256

      a0514422de97e9ebcd6f4fd7e1de1e978a67abe298aa7be582f653fedd4bceff

      SHA512

      f321cb9b4a6df1e3dd3ff1163ac447e87543d2ed77079d07a45a11069b95d98ef4448a1d5f5a971f8ca69ddede80eff17d0ccf3784438a6ccd9e638659d66004

      Download Submit

    • C:\ProgramData\FD81.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      148KB

      MD5

      88cb80f8650d8ae9c462ae7d2dad2166

      SHA1

      34c58d94cb6cdf6a7a091bcc04d45228891699bf

      SHA256

      11808aef9d9287f36605825d8233272939fa3060c944f3211694c893706b9741

      SHA512

      362748a3c3a0fabdb3b8ed13994afa5b8a1edab144e7e6eebb2ea00767e30128b4af516ee1771bc4af5d8368bd538161913edb8020ff47d683bbeec76da49d01

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      bf24e8fa143aad0c9fcd34802bf16c88

      SHA1

      19c4a75387528068dffd49c865a3dabb9d350ab1

      SHA256

      7b87ac126111ace2a89219fc8adb7506af57728450d42e508e2d22ba21b62a5d

      SHA512

      cee49b29403f15a74410ffbb0625d36fdf60da424fd29e2e092a2bf9f8465769de0185d6f8e19b30750d994274dcebc0724bea1c65fbe889893db39df53f380f

      Download Submit

    • \Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      Filesize

      4.7MB

      MD5

      61bffb5f57ad12f83ab64b7181829b34

      SHA1

      945d94fef51e0db76c2fd95ee22ed2767be0fe0b

      SHA256

      1dd0dd35e4158f95765ee6639f217df03a0a19e624e020dba609268c08a13846

      SHA512

      e569639d3bb81a7b3bd46484ff4b8065d7fd15df416602d825443b2b17d8c0c59500fb6516118e7a65ea9fdd9e4be238f0319577fa44c114eaca18b0334ba521

      Download Submit

    • memory/1412-11981-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1412-11983-0x00000000021C0000-0x0000000002200000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1412-11986-0x00000000021C0000-0x0000000002200000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1412-11985-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1412-11984-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1412-12016-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1412-12015-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2156-0-0x0000000002310000-0x0000000002350000-memory.dmp

      Filesize

      256KB

      Download