Overview

overview

10

Static

static

10

2024-12-27...de.exe

windows7-x64

10

2024-12-27...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    27-12-2024 12:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-27_d0729e9b53b9ae6898be31d4c82fcedd_darkside.exe

  • Size

    147KB

  • MD5

    d0729e9b53b9ae6898be31d4c82fcedd

  • SHA1

    4cc9743bb3a016eb97d5e12807a52789b13584a2

  • SHA256

    74b812ac49287fd6161fdad78223821f7005501fec4644eaa1dd89b6e40c2f34

  • SHA512

    21e945d238f1e00b7becbccbc1666d1e67f842ef485a5980e7da1975d2c6ccbe99af28d4a9cce36c32511ecf388456d2ead1355ed8c5c123b04b10e369bcf555

  • SSDEEP

    3072:y6glyuxE4GsUPnliByocWep0d0EVvOkEig5ErIiRq:y6gDBGpvEByocWe6ay8icEd

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\gfDvEmfFb.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: B5FEFD6406D1719DA608F1F488F83AAF Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (341) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-27_d0729e9b53b9ae6898be31d4c82fcedd_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-27_d0729e9b53b9ae6898be31d4c82fcedd_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\ProgramData\D643.tmp
      "C:\ProgramData\D643.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D643.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3052
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:1572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini
      Filesize

      129B

      MD5

      d5cdcc2ecdf242abd76aad815caf45de

      SHA1

      0d4389f645897bd075e5e231d415167b07f4eb02

      SHA256

      abb139d363c753650ec0dcac4433545771f6f0e20ae2ad13aa60da3f846e676e

      SHA512

      829e4f69aee01ebf74914fd5155eadd9ceb3dca59968c9813fbd33f83ffb58d56fa82fbc6df7067e57bc7f0a52f74d7073f1c224fef40019eae8a3d36a74ee66

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      147KB

      MD5

      f5240efc167f8593fd310c36ec10b198

      SHA1

      283f36c2b95b33772ba335d1ffbafe50b05d1d51

      SHA256

      19478d95479a60dc39a70d437b8a25c945babfe05480b7d1f981c8a2cdef5f9a

      SHA512

      908010da68219f1934e839b4a759e6c4066e685496cd092227f8fbb3ad24552351ae58a45df204f1764049e09035d1c00e157916659b4a56f4976a02041a0666

      Download Submit

    • C:\gfDvEmfFb.README.txt
      Filesize

      1KB

      MD5

      204cb8ec9e2f090f0e12e63ee923900d

      SHA1

      437c940c73d53368f37bd95e41a3a32d3d384d89

      SHA256

      90dea00850ade7929dfd7c46b363b53e385b1871d4f2a8d83d10f5bf2add0a55

      SHA512

      39131eab1cc66604802d47fda5cc69b051c9e9302aa0cdf1c9f86f5410c2e1b59164140fd8571d3824e5f21a7df93c90d3bc00611dacceebcb285bc3aab0eaaa

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      b4eb1ff736ac9c50625b13f2815a062d

      SHA1

      df1edba95a49880eaa9fb023c2de1857dee09775

      SHA256

      875def3c3dd64b4a07cc82091896b791c46836d0f6d604b98dda2c1ea676c913

      SHA512

      d3d899f70d4a1cbb52deddd365d6f41951dac37e76ee3a63e16ccc9488cdd87dbde71727161b1d7ad791b6455922309501f325564f3f831893c4cccec2f4afc5

      Download Submit

    • \ProgramData\D643.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/1788-869-0x0000000000360000-0x00000000003A0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1788-871-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1788-870-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1788-868-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1788-901-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1788-900-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2324-0-0x0000000000D50000-0x0000000000D90000-memory.dmp

      Filesize

      256KB

      Download