Overview

overview

10

Static

static

10

2024-12-13...de.exe

windows7-x64

10

2024-12-13...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2024 03:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe

  • Size

    147KB

  • MD5

    7089e64c176cdf1938e712196c246bcf

  • SHA1

    82ca26f593103d27d81460eb144efbccb1533e03

  • SHA256

    222416505b9368d2b6c19b361158dec5bffedacd44afa447c292d4f0b5288f05

  • SHA512

    16f1e1652d0579c59048ce8377eed68013f7edce3ca80418b699152cf69208cd7b8191df06b4ab4c05a2f31d76496bec14c5b3935b30d24104847fb13ceca2a3

  • SSDEEP

    3072:z6glyuxE4GsUPnliByocWepBdmmmuHu7i0XS1:z6gDBGpvEByocWeDdmmmfS1

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\4xdd7DWuD.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: ED132D71CE94E5B81218FB6EEA0FFECE Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (649) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-13_7089e64c176cdf1938e712196c246bcf_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\ProgramData\BE5E.tmp
      "C:\ProgramData\BE5E.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BE5E.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\OOOOOOOOOOO
    Filesize

    129B

    MD5

    b6a6123a8794c8aedc34f4d3f467f201

    SHA1

    e5b0d3d83f0ede811b58ce23bd692a51342cfd9f

    SHA256

    e74f99ae3d376b1a43236497db01c83294a653662d24925096a2fc6e8c4d4ea7

    SHA512

    c72a611a3b4cd04fabcefbca8cf69b09bc4b243e25520225498302efc492e2520ebdecb7654e6365e1e81704c8f4f8391dd6eada91be56c2e05cf21e5c2d5286

    Download Submit

  • C:\4xdd7DWuD.README.txt
    Filesize

    1KB

    MD5

    9c3691fd91f3ebf6f9af8638e5f5200e

    SHA1

    c4fc25c83942715db35e57c813365729af7e6717

    SHA256

    905363785bbfb15a77f1a3618bff6d479a40ef7eb55cbd321ed89c950b5c944e

    SHA512

    5de88d34e6c7a8f60fa7feab930119b8da475316be255901d366c5bc1fc3c374535cc5be476b6b4aa951970222c39937bd29387ebad0aab3c7fd7477dc78fa87

    Download Submit

  • C:\ProgramData\BE5E.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    147KB

    MD5

    a97973bb8364ac143dc870e1e0113eca

    SHA1

    dc420253ebff683ad8940911a79a1fb6cd33d8d4

    SHA256

    ee74968d3a3051e1e2faffc7ff3e562ead7b97fdd8ab33938813597dde79b54f

    SHA512

    6c704ece923758b197a6cff79abbd24d894ff9e022f9c630a2059c50fcd2e60bdabc5376251716cba199c07ced2b9c993640dc67d56eff4185b80759198b6a48

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    7e8dc35789c91097192a5ca806b8a287

    SHA1

    3ce02ffb3ff9e21fbf3ff6ae77f5d337ee9b517f

    SHA256

    9bc389c7f1d12ebf36f9dbf17ab30af2a50e2a70e304a902fe02a7b74b8089c5

    SHA512

    639cbaee79f60dee8fd7ae22cd5ecccc9c6230c0ff74c3530cc07daf514455be52a3ecb6104031d23f08b09276ccc07fa69056dc228d5012b3939080c9e02bee

    Download Submit

  • memory/1432-2988-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1432-2986-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1432-2989-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1432-2987-0x00000000023D0000-0x00000000023E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1432-3019-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1432-3020-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3116-2980-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3116-2-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3116-2985-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3116-2990-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3116-1-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3116-0-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

    Filesize

    64KB

    Download