Overview

overview

10

Static

static

10

2025-01-10...de.exe

windows7-x64

9

2025-01-10...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2025 10:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-10_f939af7974af126ea99acac00f822ad9_darkside.exe

  • Size

    145KB

  • MD5

    f939af7974af126ea99acac00f822ad9

  • SHA1

    ea407c0355ef5b01a047569e4900ceefcdc9646d

  • SHA256

    e4354736e9ff09bcc51f7cc29e1423a656806031c661098254f26f7d317d0e04

  • SHA512

    03cc1d583f3f5c324dd3833f0c8be4b6f5636a65b7c90b33c5a8c0aa64e32a53f7dc9895c531778a6de85e42a0a9d7107e42996ccf0378d9b9b421cbcb507adb

  • SSDEEP

    3072:NqJogYkcSNm9V7Dm4XsOi5yV5ZBIboxAT:Nq2kc4m9tDm4Xsz5cZ

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (634) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-10_f939af7974af126ea99acac00f822ad9_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-10_f939af7974af126ea99acac00f822ad9_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3376
    • C:\ProgramData\D802.tmp
      "C:\ProgramData\D802.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D802.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2328
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:4084
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C5FA06E9-9A94-461E-A49B-5B35FE66884E}.xps" 133809781818780000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:4616

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\BBBBBBBBBBB
      Filesize

      129B

      MD5

      a3f3c8ab205d1aa7c184fca6639c59bf

      SHA1

      d2bc899a294fd390188234fd87cab05310f7e4bd

      SHA256

      d913bb0091245427a02a150d25bd513fd1181b6968c0ca5b95bd7c4357208f46

      SHA512

      200b783615ad1f196a6a86c1791f38be0c48421b2955b23939a50e86914a87da709b17d746c95947200fa733231b83b09704baf2e2e88f4e193f09ad2c683699

      Download Submit

    • C:\ProgramData\D802.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
      Filesize

      145KB

      MD5

      4402a7ee3b507b9ba034c41ade278ba1

      SHA1

      854afa8d780883bc72e22a0e020789b9babba1df

      SHA256

      b76bd83a13d264a73bf13f62328c3ea3c41c0813c908d87bbbbf076274cf5c45

      SHA512

      4fdd631fffa1314ca7301f7ca0c5d8f23e80cd2587db4ab7f2355f326c50da836c3b0860dc99a9684911f14bf4ca1b4bfb21571db7bbec3121dad0ed5e7b6112

      Download Submit

    • C:\a18QOLqgt.README.txt
      Filesize

      314B

      MD5

      f991831e1ce551512e6718b51d0f575c

      SHA1

      b9bed428f959ff61d17c88c9ccf5d16e263d0204

      SHA256

      6800decf1bffd30653ada6039a49cec4fdbbbb9acc58968c9e4356712600814c

      SHA512

      69969bc6690c511d0dac8dbde50f110c9215851adc1bdaf6c8a7727fb4f3b5a5ba180112bb0ec7d49904c50bb07047c747cf0e65f002ef387d5e2180bc6821ab

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-2878641211-696417878-3864914810-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      e7fed710a003ab4e051ed7f3166d780d

      SHA1

      678b84b2a52b49f1d3fd2932241b321472047091

      SHA256

      6a442a5bb1973b4d5abe0b01b2e7b10d3012a5664c2d9134f011167789a7ba9a

      SHA512

      a03c2e40e3c3b0747f05c9c49972d8f31e325bef5c6d46bad5d422ad4bf49c7b7f90938fb5286eeff6980197dfb8c8469f7f245952450ae7913cb34d7a6c969b

      Download Submit

    • memory/4616-2983-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4616-2980-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4616-2982-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4616-2984-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4616-2981-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4616-3009-0x00007FFAB6020000-0x00007FFAB6030000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4616-3018-0x00007FFAB6020000-0x00007FFAB6030000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4936-2966-0x00000000024F0000-0x0000000002500000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4936-2967-0x00000000024F0000-0x0000000002500000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4936-2968-0x00000000024F0000-0x0000000002500000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4936-2-0x00000000024F0000-0x0000000002500000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4936-1-0x00000000024F0000-0x0000000002500000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4936-0-0x00000000024F0000-0x0000000002500000-memory.dmp

      Filesize

      64KB

      Download