Resubmissions
16-01-2025 09:46
250116-lrv4vsvrfl 1015-01-2025 12:06
250115-n97aystnfk 1015-01-2025 10:51
250115-mx45dssmbn 10Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-01-2025 09:46
General
-
Target
2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe
-
Size
149KB
-
MD5
274aee2df7cc4e710e92fd1cdf3c6149
-
SHA1
af5a7941c9daef02cc7d13e433227a96af79c50c
-
SHA256
6e8a174a9bcf36890ed5b6b3666400b2393a45eb21ffe826067e3124f1377c21
-
SHA512
3c9adc624bd18d51334216fc0f987df3b44202546ea58f08686d401fd2da0c1f603a3ff8f6d7225d612272cd083ccaad35ce5c1530640ae8042b62d3b80dc418
-
SSDEEP
1536:/zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDusQZpHk1/Rf1YW1Eb4QXIWLUyz:AqJogYkcSNm9V7DusUpE1phELlT
Malware Config
Extracted
C:\XIrEPF3D0.README.txt
lockbit
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-15_274aee2df7cc4e710e92fd1cdf3c6149_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\CBDC.tmp"C:\ProgramData\CBDC.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CBDC.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{739C5A1E-F2B7-4B94-BFAE-0940A9CC5CC2}.xps" 1338149440450000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5ad6aaa997938d01fa50d7c4aac0a8144
SHA1951d012002a98f489dc04a182aaf70462f39a820
SHA2568c40e6e4da27f951411ad8a580a55d9a35eac3b1441c97c5ba68c6729974a42d
SHA512b4ca6ee95d40a16dfcaf9def1206c61c835f03e1a8cda95c4ff71df6ccb7c5789a1f8c6d53f9362501d22bb1d66ac7f31adeb24a4923b9f416dd2ff3b7f52072
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
149KB
MD5d934b018091e6233192a1d589f983c18
SHA1e2466a0bcd5d0395fac70d0fd4e224cfd128e5e8
SHA256575f18cd27aef8b054a409dcf72dd683f1827a9a40d470373fad42e2167ad372
SHA5129a593bc61df2a2686eaa58e8fadcb400a8a21bbffd16cbdd5bcb53cae1e4bf3cdbf9d50149389f29373ae97abad59448ab0272e5f40664b6c19dfc97170a3b43
-
Filesize
4KB
MD5fed5782c353f8dbcef90ffeae819239c
SHA1f9b07fa165d264966dc3183b28d10753c4f9a6e4
SHA256b28f0ffcfa8d920c98c4a893f4b23ff53727ff9243e83363396c6301bb5d7f24
SHA512a28b7da7ae2e843d2f52037a51dc4fdb59bfdb708295d5e18a8ae812cbd603badb310808d786359f204d1985f27ec8cbb671393101ac9be3cfcdcebb94221393
-
Filesize
3KB
MD513bf9fb59bc3caa317d47f845baf0990
SHA160449459681777aa0e15620b08323c82722f519d
SHA256794ffaad0afeb3f5e3d08ba4f57d98ee1cfe4593abedd47692fc78136cb3c86e
SHA512b58cbcd263f2fc0cf3cfd7646e1cd11824dadb6777d48f9bb0a007b3c06c00e87f44caaf419f69c4fff3caa6c92a1b49662ac3de9cd4b59ea47e02b6757ad225
-
Filesize
129B
MD53189b2424c775798a97cdd561b760e8f
SHA1f29c12a4402de522352ead753a0931505485dfef
SHA25685f4fdc8c0fda63f1e63a3c79d887961381fa4309b2fb7357777c970a9b23a10
SHA51280c8775998e38ddbfdd897c8173c0ea0a53fdf28f40a6221ad5f683a6419e76a3791abebe830097be2d3d8bd6d6f69835bc314ea56e30da552b9124ec354601c
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB