Resubmissions
16-01-2025 09:46
250116-lrv4vsvrfl 1015-01-2025 12:06
250115-n97aystnfk 1015-01-2025 10:51
250115-mx45dssmbn 10Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-01-2025 10:51
General
-
Target
2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe
-
Size
149KB
-
MD5
274aee2df7cc4e710e92fd1cdf3c6149
-
SHA1
af5a7941c9daef02cc7d13e433227a96af79c50c
-
SHA256
6e8a174a9bcf36890ed5b6b3666400b2393a45eb21ffe826067e3124f1377c21
-
SHA512
3c9adc624bd18d51334216fc0f987df3b44202546ea58f08686d401fd2da0c1f603a3ff8f6d7225d612272cd083ccaad35ce5c1530640ae8042b62d3b80dc418
-
SSDEEP
1536:/zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDusQZpHk1/Rf1YW1Eb4QXIWLUyz:AqJogYkcSNm9V7DusUpE1phELlT
Malware Config
Extracted
C:\XIrEPF3D0.README.txt
lockbit
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\D6BA.tmp"C:\ProgramData\D6BA.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D6BA.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{CD45B5E1-D448-433C-A9B8-285BA9A023AC}.xps" 1338141190703600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD578331067ce9a7b7cc62e7690dce73992
SHA164409105113c57ed6d0ff57f7e1cbb477bfdbe3a
SHA2567b642490f81b407d10c50400b5b8b69a3b27bb729a8cceebd20f5352291b3976
SHA512e51d409ab10318acf4140a093f7ee4e66f57d0b38b85e1430df8993cefdfb6abaa7aabe891ce1b3c254cf0e07aacca85d8cdaaf0e89ab336d962f1a69658f62e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
149KB
MD5bfa70964304533ab3e7b0256c6eac383
SHA11c5316085b9aa820c1d0138fa066e455980f1e0d
SHA256a40b139eac6aa35a129ded2f5036dfe9a0a6c4090aefc56e32e4e62835058460
SHA512eff4cafc4b555d9fcfa23bcba32373a6be61118b9ea0ad30324a8a96e1c8782ebc21dcc5f5a06654e4430f4e047dd96ecc00fd28f5a7e2f4c14685b5bbd94a7a
-
Filesize
4KB
MD5d118dd38666bce14c879b6bf7fdb5402
SHA16a4439b748e86bef2e75c3b05267f865b9562dab
SHA256ccb39a1c553dc61504480fd36e5372699e516370d84b2f22757ebb13c3acf4bc
SHA512d897c0d01e13173d71b8cb3c25b0dc82274622c4824fbf23a047fd48629e4b1d878b36937a04b0384297fe4a392b1a3ac4964bbc785e61b9461a31e5a072ba7b
-
Filesize
3KB
MD513bf9fb59bc3caa317d47f845baf0990
SHA160449459681777aa0e15620b08323c82722f519d
SHA256794ffaad0afeb3f5e3d08ba4f57d98ee1cfe4593abedd47692fc78136cb3c86e
SHA512b58cbcd263f2fc0cf3cfd7646e1cd11824dadb6777d48f9bb0a007b3c06c00e87f44caaf419f69c4fff3caa6c92a1b49662ac3de9cd4b59ea47e02b6757ad225
-
Filesize
129B
MD518f693e33e4c54e606e7aaa960d7dedc
SHA19c7b120aec38e53476341e54cfa78c56e4a115c8
SHA2561e03b96e454da98381589b8910d4ca0f566021126d05ddc4c43d35e1404976e0
SHA5126c75a34ad9dd9672953e56d890e69dc058cb4ec159c4d87e87313996f77b09004da6aa8f2f902c5996998c14e2cd0622ca38df45c5f78cbad706ca08d7f1a28d
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB