Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 17:22
Behavioral task
behavioral1
Sample
2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe
-
Size
147KB
-
MD5
2827781d295d54cdb5d199c19aef469d
-
SHA1
308b01ec5ba7e3283353bb7cdbf85010017f99e8
-
SHA256
d2468b77968df53b4335668c1a5313dd007d9ab528541bab28f74b4f170988fa
-
SHA512
4afdcf585fb43e5001c77b50377f1d4c9dc2ab7925dceb1ed552e112bce6ea3ec122d18f3c08efb5a5b2e2b7fbf7cd396e53f025d5e7d5f5f3f7d69b8e73e334
-
SSDEEP
3072:36glyuxE4GsUPnliByocWepZaGGtgp8FDJ94dElJnxB:36gDBGpvEByocWe2xZFXhbnz
Malware Config
Extracted
C:\FIPNplZX1.README.txt
Signatures
-
Renames multiple (357) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1880 6B9F.tmp -
Executes dropped EXE 1 IoCs
pid Process 1880 6B9F.tmp -
Loads dropped DLL 1 IoCs
pid Process 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 1880 6B9F.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp 1880 6B9F.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeDebugPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: 36 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeImpersonatePrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeIncBasePriorityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeIncreaseQuotaPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: 33 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeManageVolumePrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeProfSingleProcessPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeRestorePrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSystemProfilePrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeTakeOwnershipPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeShutdownPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeDebugPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeBackupPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe Token: SeSecurityPrivilege 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1880 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 32 PID 2644 wrote to memory of 1880 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 32 PID 2644 wrote to memory of 1880 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 32 PID 2644 wrote to memory of 1880 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 32 PID 2644 wrote to memory of 1880 2644 2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe 32 PID 1880 wrote to memory of 1824 1880 6B9F.tmp 33 PID 1880 wrote to memory of 1824 1880 6B9F.tmp 33 PID 1880 wrote to memory of 1824 1880 6B9F.tmp 33 PID 1880 wrote to memory of 1824 1880 6B9F.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\ProgramData\6B9F.tmp"C:\ProgramData\6B9F.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6B9F.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1824
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD59893407f23e063497c3bc57cff789229
SHA1efa0750668a012c34f9c101c80c2ca6fd3b32f94
SHA2560f21abd3f559a0a43ce18efd6a01945fc618720129494bda7720047b5d233fa2
SHA512d236af7c2f7771c6b03e2389fc7405bfa3b94c2e0d9d079c8147548bc0a6b9dc1de829264d147e62f2dd0177ae2716be702b6d8e36555e2d7507bdd4f4dba025
-
Filesize
1KB
MD59483327df597616af00f2bebe2f61b14
SHA16b2eb430a7439aaced767e16986679b026cba55a
SHA2567da313fb63c0df1592fb7ee9064e24a2c528d15aa6fd08f148d6d5946c804a00
SHA512440fbbdb63472e9c8bc0e750362c14c1ed370dca828cbfd276410de0c021173273f7d9c897770a9a3b8998232cf811ae0a256936677a1880d70cc64fef70706b
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
147KB
MD5fbab34374df4bf88bdea869092710605
SHA168d7dc0d286c613498352433409c76e12d1d79fa
SHA256840383556e6bc5bb88f69b4c53d0ae73f41d27812ac6a877c9be8f1beebb9149
SHA51280b8f34707e3419a9df77aca44c281a12b57144afa0386cccc93cb5aa6574dca0542004e8a9e115f5d3846ab3859db55d01878992bd137ed006c28effd469caf
-
Filesize
129B
MD57ee1a4cc235e0d6d172dc7a8597bbb63
SHA13893802b495d004323d1e5197735c44b7286db13
SHA256c45c020bd9b0077b9b95155f6d738cb4730109a52ef6eaaa56e9f713f4c88deb
SHA5123f879f88f606e7a35319f5b6ae62d8f234957ea31fa236784ac787e0a5b5ea1495396b7ca072f9d0a982988f0a20a55acac6383f4b43d2715249c760a8ec230e