General
-
Target
2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside
-
Size
149KB
-
Sample
250116-lrv4vsvrfl
-
MD5
274aee2df7cc4e710e92fd1cdf3c6149
-
SHA1
af5a7941c9daef02cc7d13e433227a96af79c50c
-
SHA256
6e8a174a9bcf36890ed5b6b3666400b2393a45eb21ffe826067e3124f1377c21
-
SHA512
3c9adc624bd18d51334216fc0f987df3b44202546ea58f08686d401fd2da0c1f603a3ff8f6d7225d612272cd083ccaad35ce5c1530640ae8042b62d3b80dc418
-
SSDEEP
1536:/zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDusQZpHk1/Rf1YW1Eb4QXIWLUyz:AqJogYkcSNm9V7DusUpE1phELlT
Behavioral task
behavioral1
Sample
2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\XIrEPF3D0.README.txt
lockbit
https://tox.chat/download.html
Targets
-
-
Target
2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside
-
Size
149KB
-
MD5
274aee2df7cc4e710e92fd1cdf3c6149
-
SHA1
af5a7941c9daef02cc7d13e433227a96af79c50c
-
SHA256
6e8a174a9bcf36890ed5b6b3666400b2393a45eb21ffe826067e3124f1377c21
-
SHA512
3c9adc624bd18d51334216fc0f987df3b44202546ea58f08686d401fd2da0c1f603a3ff8f6d7225d612272cd083ccaad35ce5c1530640ae8042b62d3b80dc418
-
SSDEEP
1536:/zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDusQZpHk1/Rf1YW1Eb4QXIWLUyz:AqJogYkcSNm9V7DusUpE1phELlT
-
Lockbit family
-
Renames multiple (354) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-