Resubmissions
16-01-2025 09:46
250116-lrv4vsvrfl 1015-01-2025 12:06
250115-n97aystnfk 1015-01-2025 10:51
250115-mx45dssmbn 10Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-01-2025 12:06
General
-
Target
2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe
-
Size
149KB
-
MD5
274aee2df7cc4e710e92fd1cdf3c6149
-
SHA1
af5a7941c9daef02cc7d13e433227a96af79c50c
-
SHA256
6e8a174a9bcf36890ed5b6b3666400b2393a45eb21ffe826067e3124f1377c21
-
SHA512
3c9adc624bd18d51334216fc0f987df3b44202546ea58f08686d401fd2da0c1f603a3ff8f6d7225d612272cd083ccaad35ce5c1530640ae8042b62d3b80dc418
-
SSDEEP
1536:/zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDusQZpHk1/Rf1YW1Eb4QXIWLUyz:AqJogYkcSNm9V7DusUpE1phELlT
Malware Config
Extracted
C:\XIrEPF3D0.README.txt
lockbit
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (665) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\C489.tmp"C:\ProgramData\C489.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C489.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{948FE00B-A28B-4163-A4A3-0F07FF0273A4}.xps" 1338141642637300002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5456b9ed5b649379c2b8b6702178f752a
SHA139d8b57372be72e5c3614e2677a5f465b64d05bd
SHA2561e6e5c53dd16452a08efe46f31f35ac91bf4cc93c979f8b7ed43aeaa88a5f248
SHA5126377c44f9a4f72df85178670d244adc05eaa4b2322f576b4f70a014805936e27ef7f842e3c2ccf3bd72869775ac731e12cb284eae8ebf04dee68d37ab4e625de
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
149KB
MD59cf0143423d86de11592309028ac9baa
SHA1d9c3d9ea8b1c330b24a0e939c9b18ec14094e826
SHA256a8850927318e639d90eb1052990efcf071bcb40cfaa495466f661f0c0b55dd62
SHA5129f93079a5fae7ee63b2a3124043f8364baaac21a26d45732c393a58b181afd6c761206c30a5f0513a73a0a60bd69241fd120695a0a95bff2ff39b88aad0da863
-
Filesize
4KB
MD56027975e6c2cbed5ef1ee8b643688ccd
SHA1e47a60c96eedd88169a6625f2b70499f152c4264
SHA256e29114d0e9844b139a01a8a783ea4e1c617e187b26cf5097c1d1e4d7a9b14fb8
SHA5121d7e86aac74007651427f97456eef10428fee98d03cc0f8920aecd612cdffbcc0e4edd61d4a5ac6cfcf93bcc7394c5bdcf3dd4d06706fb04c34805f31dde3471
-
Filesize
4KB
MD5741bf07483f3e811d8812c6c4540de54
SHA1533577185efbbcd0fa3b85a67c586f0124633dda
SHA256908d3c0425a7931d3bda6fb0fcc5c429e90b1f7dc65e364488289ca1aa469ed7
SHA5120ab8d290e9addf98f8a0db21e72f5ffc0fd7f3737ada1c7d143636460cac5ec8150553162bd851aba7f5beece200ce62376d7539373837551e356f3c632c99f7
-
Filesize
3KB
MD513bf9fb59bc3caa317d47f845baf0990
SHA160449459681777aa0e15620b08323c82722f519d
SHA256794ffaad0afeb3f5e3d08ba4f57d98ee1cfe4593abedd47692fc78136cb3c86e
SHA512b58cbcd263f2fc0cf3cfd7646e1cd11824dadb6777d48f9bb0a007b3c06c00e87f44caaf419f69c4fff3caa6c92a1b49662ac3de9cd4b59ea47e02b6757ad225
-
Filesize
129B
MD547debaa8006c576f13a2df0c6d41a853
SHA1515952ee0d21aadb4c15e7f0c7a31442331cc9c3
SHA2564409f2c64c4c86f23b0783d8c8eaa8d56efa19d505f879af49e6d3f925a2c6dd
SHA512e4a9b83c2b0c2e83b962779e86533233495ca3917589c79776c5522167843eff78606d2c798033f755f895915d83e2a59252305e395581789623d86d6c851d6a
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB