Overview

overview

10

Static

static

10

2024-12-13...de.exe

windows7-x64

10

2024-12-13...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2024 03:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe

  • Size

    147KB

  • MD5

    7089e64c176cdf1938e712196c246bcf

  • SHA1

    82ca26f593103d27d81460eb144efbccb1533e03

  • SHA256

    222416505b9368d2b6c19b361158dec5bffedacd44afa447c292d4f0b5288f05

  • SHA512

    16f1e1652d0579c59048ce8377eed68013f7edce3ca80418b699152cf69208cd7b8191df06b4ab4c05a2f31d76496bec14c5b3935b30d24104847fb13ceca2a3

  • SSDEEP

    3072:z6glyuxE4GsUPnliByocWepBdmmmuHu7i0XS1:z6gDBGpvEByocWeDdmmmfS1

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\4xdd7DWuD.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: ED132D71CE94E5B84D096E994CA0E05B Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (614) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\ProgramData\B759.tmp
      "C:\ProgramData\B759.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B759.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\HHHHHHHHHHH
    Filesize

    129B

    MD5

    4d6dd6cef5c2fdc204039770c2f7883e

    SHA1

    c563bad38e9530cb5a753d05eca3752c4077c9b3

    SHA256

    10b21188edca84c7ca36aa848398e8d3b4440b51a6dff90d44c24bcb18cb320d

    SHA512

    bf8035bd6fadf7c9e32c810ca442bdedcb6c2fb0f3f2ded532bc8c7a74b47550871189d583fbb69780aacb69af22e3b3abb5faee15403bdabda7f562050475ab

    Download Submit

  • C:\4xdd7DWuD.README.txt
    Filesize

    1KB

    MD5

    70c9f7ac36c6feaf90d9cf8a327806b0

    SHA1

    e03b9ca0a3cf8c9a812f5cb675101e182dae93e9

    SHA256

    87dc959548d1985297c0f9f4e63d9aefc2f0701bdd711f6b4f5f9c92618c0a9d

    SHA512

    53e1a1c496ca6e33deb9e88d8cbef5fdf7c8a00a80e93e9c8d530946c1f6a44a720fc636beb296becb88491d676c4d339601f04e48eae6823af93cf3d8278f28

    Download Submit

  • C:\ProgramData\B759.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    147KB

    MD5

    2280807e3e685b8089ec8f49d1f41ae8

    SHA1

    a2f55ba0886411fe208dd90280eba85e47384701

    SHA256

    0330d891678aa4ea6af5942fe231a4e971a1ea4a9658bfcc935c7915e4cad0f2

    SHA512

    6752f18cd42fb55d0610eb4d74e54880dd09da8f9738913b0a4d271508558de2cc610be41807a20028f7a6bfa59058f8ddef001e95c553655e50e3576fdfce12

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    f411a61c94f645b60d2db0f3f08bebb6

    SHA1

    d9cabfb1552e058b3a90796d0525716457958ada

    SHA256

    2f815ae5aac10ef29e2cbac10cb4ec532b3e934332ca6d286bb2544e2fd3da92

    SHA512

    6091746c7c9d434ecaa8aa8dbc9b3172f44f05f0b7d7db130dcc05a5be453a91e780c143938419269a3f1472368e34e7f8ec585cab10adf81ca78d400aa5ae41

    Download Submit

  • memory/1904-2796-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1904-2795-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1904-2794-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1904-2826-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1904-2827-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5068-2-0x0000000000D10000-0x0000000000D20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5068-0-0x0000000000D10000-0x0000000000D20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5068-1-0x0000000000D10000-0x0000000000D20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5068-2797-0x0000000000D10000-0x0000000000D20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5068-2793-0x0000000000D10000-0x0000000000D20000-memory.dmp

    Filesize

    64KB

    Download