Overview

overview

10

Static

static

10

2025-01-10...de.exe

windows7-x64

9

2025-01-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    74s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    10-01-2025 10:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-10_f939af7974af126ea99acac00f822ad9_darkside.exe

  • Size

    145KB

  • MD5

    f939af7974af126ea99acac00f822ad9

  • SHA1

    ea407c0355ef5b01a047569e4900ceefcdc9646d

  • SHA256

    e4354736e9ff09bcc51f7cc29e1423a656806031c661098254f26f7d317d0e04

  • SHA512

    03cc1d583f3f5c324dd3833f0c8be4b6f5636a65b7c90b33c5a8c0aa64e32a53f7dc9895c531778a6de85e42a0a9d7107e42996ccf0378d9b9b421cbcb507adb

  • SSDEEP

    3072:NqJogYkcSNm9V7Dm4XsOi5yV5ZBIboxAT:Nq2kc4m9tDm4Xsz5cZ

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (333) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-10_f939af7974af126ea99acac00f822ad9_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-10_f939af7974af126ea99acac00f822ad9_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\ProgramData\68D1.tmp
      "C:\ProgramData\68D1.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\68D1.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:524
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x154
    1⤵
      PID:2720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\AAAAAAAAAAA
      Filesize

      129B

      MD5

      806a25b10e037ed52398481d5d2e0ff3

      SHA1

      38f4ca9fd2792d6fd148c72af193c98f2bee3798

      SHA256

      52d5264297b633a37637a406a9d717aac13e94efdf58ca0201ab1e8fbcf09d80

      SHA512

      62e7d4962a04d64571c11b5e0124b1cf942d0d045dc7c40b8aba16212b8325438eafcdf2ebaac6f2ccfefb7540c315c6d1a7d41ee3c796a57140e30dda0a0ed2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      145KB

      MD5

      fa33215e88d7d7f8a51001397e286063

      SHA1

      5aa9115daad6a87a79769bf56932339f0fa0711d

      SHA256

      78d930fd63cb844edd1f808920e29db03286fc343e74160aebd145d2a2dd2356

      SHA512

      ab04101cb002f65a10a8a45d52370a4541ed3591a38f73cbe2c77272572c9fc3b028fa49d643649a19b89783a4bd0941b163cb3ec22438e6727cdf475ecafbf2

      Download Submit

    • C:\a18QOLqgt.README.txt
      Filesize

      314B

      MD5

      f991831e1ce551512e6718b51d0f575c

      SHA1

      b9bed428f959ff61d17c88c9ccf5d16e263d0204

      SHA256

      6800decf1bffd30653ada6039a49cec4fdbbbb9acc58968c9e4356712600814c

      SHA512

      69969bc6690c511d0dac8dbde50f110c9215851adc1bdaf6c8a7727fb4f3b5a5ba180112bb0ec7d49904c50bb07047c747cf0e65f002ef387d5e2180bc6821ab

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      a554ab4e38e65d93b207075d8345a566

      SHA1

      293d6d20363e634a6d65b9a1f2347ddc9e00ff14

      SHA256

      3d18b115537b69199e98b8709cbf235d2ac0d59c0561de4ef0dffb1741c95c5b

      SHA512

      e1d722596a55ce1633209b381941f056fdcb9c9d3dc2cbc5c5d0e7a734386deea321fdf88eb931ee977e54c2e705116d228a8a41f5e43f971e60bdb9a6e64db1

      Download Submit

    • \ProgramData\68D1.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/2124-0-0x0000000000CD0000-0x0000000000D10000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2580-860-0x0000000000290000-0x00000000002D0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2580-863-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2580-862-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2580-861-0x0000000000290000-0x00000000002D0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2580-858-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2580-893-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2580-892-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

      Download