Overview

overview

10

Static

static

10

2024-12-27...de.exe

windows7-x64

10

2024-12-27...de.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-12-2024 12:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-27_d0729e9b53b9ae6898be31d4c82fcedd_darkside.exe

  • Size

    147KB

  • MD5

    d0729e9b53b9ae6898be31d4c82fcedd

  • SHA1

    4cc9743bb3a016eb97d5e12807a52789b13584a2

  • SHA256

    74b812ac49287fd6161fdad78223821f7005501fec4644eaa1dd89b6e40c2f34

  • SHA512

    21e945d238f1e00b7becbccbc1666d1e67f842ef485a5980e7da1975d2c6ccbe99af28d4a9cce36c32511ecf388456d2ead1355ed8c5c123b04b10e369bcf555

  • SSDEEP

    3072:y6glyuxE4GsUPnliByocWep0d0EVvOkEig5ErIiRq:y6gDBGpvEByocWe6ay8icEd

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\gfDvEmfFb.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: B5FEFD6406D1719D7422DD76126BBCE8 Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (637) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-27_d0729e9b53b9ae6898be31d4c82fcedd_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-27_d0729e9b53b9ae6898be31d4c82fcedd_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\ProgramData\B4AA.tmp
      "C:\ProgramData\B4AA.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3604
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B4AA.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\GGGGGGGGGGG
    Filesize

    129B

    MD5

    cb94856c8651c6e704ae834c20fe1a91

    SHA1

    8abf0a6e20bffa3b3a8a73dce21e9c03b14a66eb

    SHA256

    dc6af174b3c63431a92dfd87bc85979b4ae95cc198325bf1c188e33f6dc97a70

    SHA512

    0dac45b2a9329059b0e0d17cedfdf60445a9bdef328f5067a3085d05bd0a85875186216f0fed5e6163941a0daaf6d3f159e266cc64044b2cb813e069d84b40fa

    Download Submit

  • C:\ProgramData\B4AA.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    147KB

    MD5

    221a8f4c1a42ce0beef7d0398bb340c8

    SHA1

    7b4a93360d5b2f9636f19e22211f299179964cee

    SHA256

    b4e6062b503f0add6ee1f90b5e2dfa5442d349b10f91357e9e4c582ff9105a33

    SHA512

    be5949fa96051ca98dbe6df38d98002c94a08ff7afedf4c98a1972a2ee9900b93e871ba6a532551d3bc7c7c188bdc567c84555aa1a64cc3de8131480c57ed2fa

    Download Submit

  • C:\gfDvEmfFb.README.txt
    Filesize

    1KB

    MD5

    7cd0945f775d01050a9a083081e365ef

    SHA1

    11620d1f9b9788717a481bc851a761fecc659661

    SHA256

    058c556231462dc4d1d8ddb86524775eff4a6bcedeab764b1a73f79d41547cc5

    SHA512

    012ce0610986abc809bc0eacc3e85523ae624f55b35dc1a803335f15c552c5870393951d0e838e46f99631380e047afb37ddd3b2624a6336cdb2474a92299b76

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-2878641211-696417878-3864914810-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    f68d4df50f06d08bf80c04e17faeb7ef

    SHA1

    f5951efb6a5abae9984cb66e2b9c46b54f013906

    SHA256

    fec67a2a3b6e64055782b52a97e2d38a38803e7ad9cb493df8006f928c1acfcf

    SHA512

    fccd396176c210e1c4d3e88346107655694a37f3dfc4f4f7924180722bc7ffddc925d441b9b75129c0f18f91889b1524ee15567a0a0a969f9ad92eee98bc3bb2

    Download Submit

  • memory/3192-2890-0x00000000026A0000-0x00000000026B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3192-2884-0x00000000026A0000-0x00000000026B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3192-2885-0x00000000026A0000-0x00000000026B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3192-2-0x00000000026A0000-0x00000000026B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3192-1-0x00000000026A0000-0x00000000026B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3192-0-0x00000000026A0000-0x00000000026B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3604-2891-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3604-2892-0x00000000027D0000-0x00000000027E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3604-2894-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3604-2893-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3604-2923-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3604-2924-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB

    Download