Overview

overview

10

Static

static

10

2024-12-13...de.exe

windows7-x64

10

2024-12-13...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    84s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 03:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe

  • Size

    147KB

  • MD5

    7089e64c176cdf1938e712196c246bcf

  • SHA1

    82ca26f593103d27d81460eb144efbccb1533e03

  • SHA256

    222416505b9368d2b6c19b361158dec5bffedacd44afa447c292d4f0b5288f05

  • SHA512

    16f1e1652d0579c59048ce8377eed68013f7edce3ca80418b699152cf69208cd7b8191df06b4ab4c05a2f31d76496bec14c5b3935b30d24104847fb13ceca2a3

  • SSDEEP

    3072:z6glyuxE4GsUPnliByocWepBdmmmuHu7i0XS1:z6gDBGpvEByocWeDdmmmfS1

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\4xdd7DWuD.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: ED132D71CE94E5B81CB5F934BA2D4847 Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (364) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\ProgramData\16BC.tmp
      "C:\ProgramData\16BC.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\16BC.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2536
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:1292

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini
      Filesize

      129B

      MD5

      900cfa515a9143158a734f31e28b8a47

      SHA1

      b7e777d96965bd4e33cc39cdbe468f795be582d9

      SHA256

      de08bd2edccac6fbe96b74ce4edabccdaccf68fea0a23b83e264aa8c301ab0e1

      SHA512

      62defc16427701ba3b7766dec33cc954ff5c360e09add8564084504b0f4b116757db6b858a3f2fdf8116fca607343003757803dba2f99ae25ab7170e6d5f96fb

      Download Submit

    • C:\4xdd7DWuD.README.txt
      Filesize

      1KB

      MD5

      2ae11194b1cfe8a397c7eebb9ae4f242

      SHA1

      dcef54c68f9e6202db3ea523889a46f5fcbd81f7

      SHA256

      eb804952c3b1410135c5082d3e8a5a0e1082b0c89ac08552c32c33e6cb6dc85c

      SHA512

      22b6b425c0cac86d0708f5368dd551fc9ead47d6ce474af11dee9b4d859663d82948ba71774d0db905a712a304138374c6c1d128c29d3cea99932ddae8012627

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      147KB

      MD5

      7e2809e2a4283ec41f2a7aff30eaaae2

      SHA1

      189c36dfb5f6281b3be8199b3f4d1c983c3a59da

      SHA256

      a523a5ef8d2c9aeeace66c7048780e59f342221938add849edc4090ad0ce0168

      SHA512

      aa4bb20730e6f8dfd3c1c2f5ca66e3177afaebdd9cf491fc5f6f38ab0dcd64816f2b8829331714733785e5ad50a7c9b83b75bf65573bd56abf7804438368094a

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-2703099537-420551529-3771253338-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      832309d6eab81784a84858d7b4d1968d

      SHA1

      3e36e0607bb003fc565f17149edc3fafa5d792a6

      SHA256

      a36994994d8b51b08dcabb40792885ba7222b14bff74b2dbbb62cc538fa5ff48

      SHA512

      2c8f6ae2429d1203ab00dcc6766fd461491772a88192b25c3b4c87a3379b0d56f24874e842343cdc864c98d78082c99bc2be1370b55f6edf3d3e8bc28a5d7b11

      Download Submit

    • \ProgramData\16BC.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/1308-0-0x00000000001E0000-0x0000000000220000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2728-884-0x0000000000401000-0x0000000000404000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2728-888-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2728-887-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2728-886-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download