Overview

overview

10

Static

static

10

2024-12-13...de.exe

windows7-x64

10

2024-12-13...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 01:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-13_107d3c9b830ddd884f3ca5761e777f9b_darkside.exe

  • Size

    148KB

  • MD5

    107d3c9b830ddd884f3ca5761e777f9b

  • SHA1

    36c6830e16f46d00e16431175b31f3565aa5b4c8

  • SHA256

    bc20b30abf15d6374ef9094a49f0875b53c154a0fcb3ae6e054d678091208f70

  • SHA512

    7a061b642955fc1775e0cec5b4f4deef4e22ad0ceeed4b15c948c3f1fbf42c166554c71212a3c874b8a0177a255f1da6b64af4225d0de99e7d87ccd598c3ecb3

  • SSDEEP

    3072:46glyuxE4GsUPnliByocWepCnkOry1yC8Nwt:46gDBGpvEByocWeSkOmC

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\8gduxxdQN.README.txt

Ransom Note
Ni hao! Your data are stolen and encrypted. In case of nonpayment - all information will be sold or made publicly accessible, and we will also continue to attack your servers. Compared to other ransomware we charge a lot less, so don't be stingy!:-) If you pay - we will provide you with decryption software and remove your data from our servers. We will also let you know about the vulnerability in your servers that we used to infiltrate your network. WARNING! Do not delete or modify any files, it can lead to recovery problems! You can contact us using Session messenger without registration and sms https://getsession.org/download My Session ID: 05839c6cce78c3f3043e7a65c27e881cbb9efbda3bab942d273a496876340b254f You also can contact us using Tox messenger without registration and SMS https://tox.chat/download.html My Tox ID: BF2FBB22C4CFD24EF9AFE2CAB694D8C1E3E2340393E846514659C59D8C52F43CBD76209603AE You can send us any 1 file for free decryption. Good luck! 您好！ 您的数据已被窃取并加密。 如果不付款，所有信息将被出售或公开，我们将继续攻击您的服务器。 与其他勒索软件相比，我们的收费要低得多，所以不要小气！ 如果您付款，我们将为您提供解密软件，并从我们的服务器上删除您的数据。 我们还会让你知道我们利用你服务器上的漏洞来渗透你的网络。 警告：请勿删除或修改任何文件，否则可能导致恢复问题！ 您可以使用无需注册的会话信使和短信 https://getsession.org/download 与我们联系。 我的会话 ID: 05839c6cce78c3f3043e7a65c27e881cbb9efbda3bab942d273a496876340b254f 您也可以使用 Tox 使者（无需注册）和 SMS https://tox.chat/download.html 与我们联系。 我的 ID: BF2FBB22C4C4CFD24EF9AF9AFE2CAB694D8C1E3E2340393E846514659C59C59D8C52F43CBD76209603AE 您可以将任意 1 个文件发送给我们进行免费转录。 祝您好运
URLs

https://getsession.org/download

https://tox.chat/download.html

Signatures

  • Renames multiple (8043) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-13_107d3c9b830ddd884f3ca5761e777f9b_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-13_107d3c9b830ddd884f3ca5761e777f9b_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\ProgramData\50A0.tmp
      "C:\ProgramData\50A0.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\50A0.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:788
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:3008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\EEEEEEEEEEE
      Filesize

      129B

      MD5

      b190212ecb1014758cbcc3cd8b86aa5d

      SHA1

      706949b7d2bcc13533df3de62353bd0b825a7d6e

      SHA256

      c9afff23073bc8125482eb5911f4036be2094a045a1055ddc6cce13098692bce

      SHA512

      d45199b9ae186142e45c27193fb6beda1eab9eebb3595d511c0c1f1611b54cee9101a8e6544d1121436309e21ec558bc4940563a5741ac768d0be79a43a55800

      Download Submit

    • C:\8gduxxdQN.README.txt
      Filesize

      2KB

      MD5

      d16734b43544f0e05d570563c001e4eb

      SHA1

      73cef7171e473b7ebbec10511baa694ba51d38ae

      SHA256

      a0514422de97e9ebcd6f4fd7e1de1e978a67abe298aa7be582f653fedd4bceff

      SHA512

      f321cb9b4a6df1e3dd3ff1163ac447e87543d2ed77079d07a45a11069b95d98ef4448a1d5f5a971f8ca69ddede80eff17d0ccf3784438a6ccd9e638659d66004

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      148KB

      MD5

      bb727157a6e2d3d30a7f07e971b06df9

      SHA1

      f2072416adfe77db2edb6b648adf9934769cc856

      SHA256

      890c1b9c26a8492779d1d5bbdf5e02634202d3a43062cd8ac38c4e0f2067c528

      SHA512

      6891a78999f691f4a750e9dd4e86bfeacbfc6b7ee7802c743ef3b6141d6159595299d5cd9d2b48e9dc189920ef494f4887f17daffbd4c5fdabb89c56f77b46d5

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-1488793075-819845221-1497111674-1000\HHHHHHHHHHH
      Filesize

      129B

      MD5

      2ce7792af04eb990c9d5572685dfef9c

      SHA1

      d6426abb4bd3e8cec30b8fb217b552b182e16b76

      SHA256

      401bab971041e3cfd07f2b246f0b358f5a0896c3a7aca963e6def298179f01b3

      SHA512

      8cfb017510861457e31a9c4282c8c36408b8652ae4b7ccbd818d7cbd959f43f1dc3720dc92fa2d7336feb72bd2c20e1d9046b2c9250ba1e3067d79fd5d4fe821

      Download Submit

    • \Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      Filesize

      4.7MB

      MD5

      61bffb5f57ad12f83ab64b7181829b34

      SHA1

      945d94fef51e0db76c2fd95ee22ed2767be0fe0b

      SHA256

      1dd0dd35e4158f95765ee6639f217df03a0a19e624e020dba609268c08a13846

      SHA512

      e569639d3bb81a7b3bd46484ff4b8065d7fd15df416602d825443b2b17d8c0c59500fb6516118e7a65ea9fdd9e4be238f0319577fa44c114eaca18b0334ba521

      Download Submit

    • \ProgramData\50A0.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/1316-0-0x0000000002160000-0x00000000021A0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2848-11997-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2848-12001-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2848-12000-0x0000000002160000-0x00000000021A0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2848-11999-0x0000000002160000-0x00000000021A0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2848-12002-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2848-12032-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2848-12031-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

      Download