Overview

overview

10

Static

static

10

2024-12-13...de.exe

windows7-x64

10

2024-12-13...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 03:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe

  • Size

    147KB

  • MD5

    7089e64c176cdf1938e712196c246bcf

  • SHA1

    82ca26f593103d27d81460eb144efbccb1533e03

  • SHA256

    222416505b9368d2b6c19b361158dec5bffedacd44afa447c292d4f0b5288f05

  • SHA512

    16f1e1652d0579c59048ce8377eed68013f7edce3ca80418b699152cf69208cd7b8191df06b4ab4c05a2f31d76496bec14c5b3935b30d24104847fb13ceca2a3

  • SSDEEP

    3072:z6glyuxE4GsUPnliByocWepBdmmmuHu7i0XS1:z6gDBGpvEByocWeDdmmmfS1

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\4xdd7DWuD.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: ED132D71CE94E5B83359C18182156663 Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (328) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\ProgramData\C5CF.tmp
      "C:\ProgramData\C5CF.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:336
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C5CF.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2188
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x148
    1⤵
      PID:1568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini
      Filesize

      129B

      MD5

      0c110daa42d2e8893ccf8eac1167be62

      SHA1

      518d48454b730d2d6d11a99cc27f41e8db239c3c

      SHA256

      9c62726aa6d8faacc6bf7869a7144e9dddd67de7c7e2b0115deb814f3e1a9b4a

      SHA512

      7c7fb08de3fd92899167f6e7fefc99d299851dafc999fa0d8cbbc086a02ebf8ccd44ccc6b9308b1912a3b07c52ce73c4a8a8696e86d1a24a3d972df57eb9eaf6

      Download Submit

    • C:\4xdd7DWuD.README.txt
      Filesize

      1KB

      MD5

      81de0747475d79ef34736aa71fec345a

      SHA1

      0beb0d4633bf65b81a926317de7153dd1c74c5c6

      SHA256

      bc9319a1082e80c734a3a246e92fee23a5d2c4023f38142ef43d5f7df6851b2b

      SHA512

      41ead29b56b5f105f7b1719271dde3ce7e994cd044021642ed795241454369c04386da3254bab7efe4042f07267559105cab095ac9fb5f5fb0ccd797183dd090

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      147KB

      MD5

      4bb3d0ed4a14d0c8b670b0bb191ef828

      SHA1

      72689f1b217f9434b78c060dc74410475d793bad

      SHA256

      0ed291e8a2ec6e8995a72a418c70caba25cb0eed3a27bd285de4a58d5deed746

      SHA512

      a1060bd3bdfac8f91b08fa43d8e205782b0012e720b9d70e839aa5388da3ff4c26289e77651d1f6ad76d6c6aa55c03f7eb6918e5ae6a47cf5f166b6a9135625b

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3533259084-2542256011-65585152-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      b41e285ef27cbc69ec2401d3f66b860b

      SHA1

      00ea6689f80bb7f35492f6387e76c14b7c892aff

      SHA256

      fd7a16ac3d0a2fb20271dced871cb5aa73d4111055ccec04f3d244b30d0e364a

      SHA512

      1e8f07eb1ee1caa4f4d702fa08a72fcd66b3c74643c5b222f953f8a9ceb7868654588f7425755d3a6723e3a0472b7dc08262b2e90f8bebac7e50781601ef90cc

      Download Submit

    • \ProgramData\C5CF.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/336-858-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/336-860-0x0000000002100000-0x0000000002140000-memory.dmp

      Filesize

      256KB

      Download

    • memory/336-862-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/336-861-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/336-892-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/336-891-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2504-0-0x0000000000C90000-0x0000000000CD0000-memory.dmp

      Filesize

      256KB

      Download