Overview

overview

10

Static

static

10

2024-12-16...de.exe

windows7-x64

10

2024-12-16...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 17:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe

  • Size

    147KB

  • MD5

    2827781d295d54cdb5d199c19aef469d

  • SHA1

    308b01ec5ba7e3283353bb7cdbf85010017f99e8

  • SHA256

    d2468b77968df53b4335668c1a5313dd007d9ab528541bab28f74b4f170988fa

  • SHA512

    4afdcf585fb43e5001c77b50377f1d4c9dc2ab7925dceb1ed552e112bce6ea3ec122d18f3c08efb5a5b2e2b7fbf7cd396e53f025d5e7d5f5f3f7d69b8e73e334

  • SSDEEP

    3072:36glyuxE4GsUPnliByocWepZaGGtgp8FDJ94dElJnxB:36gDBGpvEByocWe2xZFXhbnz

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\FIPNplZX1.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: 057A7C74C1AE5F493A6A4AAE3F9FB3B6 Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (623) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\ProgramData\D1A8.tmp
      "C:\ProgramData\D1A8.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D1A8.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini
    Filesize

    129B

    MD5

    3aa0253a550f11d53d3b6769f45fbf8c

    SHA1

    a2a1be04da534b265dddb59dca342aa136a40eb5

    SHA256

    db9d5ac6b30c7300aad48aafab22a34bdf25ebd4ccc5f0cf958ae8b697bfeca6

    SHA512

    073bfc702f7670696211a24ad5e22f42466160b31ac0d83ec5132fe33a158538dfe6a8fbd5040e192d7f5151f5f91f412706e7ba6c2143388086d69fe44f813b

    Download Submit

  • C:\FIPNplZX1.README.txt
    Filesize

    1KB

    MD5

    4e96775ffff64f3798d6d9dac0138b20

    SHA1

    4e73a802b73a07484455711b28e6a1282f927634

    SHA256

    1a1f27af50d408bb2739b0a05b15ee0a3bac58766a90ffdd82f376a836147e2b

    SHA512

    92261a98e9cef3274cde58622ad1f1a4a2af24bb409ce1b71ae5ae6e9cdf2a2dbc32e7aad73a8bc234da470ebb27c3a834ce9917cfd524017a9d07e45d6ae52f

    Download Submit

  • C:\ProgramData\D1A8.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    147KB

    MD5

    5e7540c894e29b793895264cee786297

    SHA1

    067ef0284387f7dc9db645801f0f7bfeb80185c2

    SHA256

    4cced4785389585140ce85df71dd8f453a1976472713fa1d967d1943c0b7303f

    SHA512

    bdb00c846ea56cf81a3b3a2bdb392040661bcfd92bff88da400a8c33773ec2a974f6e523d4e8b6840925d19ffe36291ae9c0f20177ef1343b0313df59d5933d3

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-3350944739-639801879-157714471-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    977bf9f8f8f89c92b1084e2df96e3911

    SHA1

    37ec46c7a590934d6e5599986f8d8c9c52539f0b

    SHA256

    f161533abfe5e4084035a7ba762b74e458e287d71256f7253e9d483871c5e3df

    SHA512

    184a84bd4d27fe4b0b9235af0e9278adcf476b4ee3b31503349b9572bda0f9ff8620f4108a81cd80f0ca95bb41c1bac88d4ab6bccae699ffe1a758db2123aafe

    Download Submit

  • memory/872-2963-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/872-1-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/872-2957-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/872-2958-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/872-2-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/872-0-0x0000000002C20000-0x0000000002C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2104-2968-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2104-2965-0x00000000025E0000-0x00000000025F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2104-2964-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2104-2966-0x00000000025E0000-0x00000000025F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2104-2967-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2104-2997-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2104-2998-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB

    Download