Overview

overview

10

Static

static

10

2024-12-16...de.exe

windows7-x64

10

2024-12-16...de.exe

windows10-2004-x64

10

Resubmissions

19-01-2025 12:20

250119-ph3zwsxnhq 10

16-12-2024 17:22

241216-vxp98sxjbj 10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2025 12:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe

  • Size

    147KB

  • MD5

    2827781d295d54cdb5d199c19aef469d

  • SHA1

    308b01ec5ba7e3283353bb7cdbf85010017f99e8

  • SHA256

    d2468b77968df53b4335668c1a5313dd007d9ab528541bab28f74b4f170988fa

  • SHA512

    4afdcf585fb43e5001c77b50377f1d4c9dc2ab7925dceb1ed552e112bce6ea3ec122d18f3c08efb5a5b2e2b7fbf7cd396e53f025d5e7d5f5f3f7d69b8e73e334

  • SSDEEP

    3072:36glyuxE4GsUPnliByocWepZaGGtgp8FDJ94dElJnxB:36gDBGpvEByocWe2xZFXhbnz

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\FIPNplZX1.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: 057A7C74C1AE5F49D37C19356B8F91E3 Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (611) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-16_2827781d295d54cdb5d199c19aef469d_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\ProgramData\B9EA.tmp
      "C:\ProgramData\B9EA.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B9EA.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1300
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FIPNplZX1.README.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:2992
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FIPNplZX1.README.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:3492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    0ec67b6120c98f3b3bcb9c321f9fee7c

    SHA1

    25d449a73ad63dc72f55718ffdb28b0cc74d62ac

    SHA256

    93706eef4df0526598f364a33083f9b5a049d13ba79c64d972035b76ea83b4f2

    SHA512

    c8ac15ab0aaef1ae0f19431d9e029eff18e3ae0607cf3dc1a1c8e85d95d6434e966ababa6a243dffd66ee45101e22a3e6e23d3d573b843461310a250c3ab2ee6

    Download Submit

  • C:\FIPNplZX1.README.txt
    Filesize

    1KB

    MD5

    9a1ef3642d5d8e18527b1a260d90a9ad

    SHA1

    32b4b9fdcca8ab0f879f09cfd81cc5f77c5474ad

    SHA256

    fb8ac53c609a1ff132eeb24dcd66181c1414af6b811024cbb7ae492f631f2834

    SHA512

    3c308574d5afeef9ce0778ec77e2f37301aac3dfb0a77dd3f890a68fdf6848efca920759ce43cf2a6a3f89e96f424a9a07a6aa565efdf96a07a72336d19738e5

    Download Submit

  • C:\ProgramData\B9EA.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
    Filesize

    147KB

    MD5

    4a92987eadd3c310623c155166f211b9

    SHA1

    4774375199501cd8943b8e132298230f4ef80020

    SHA256

    b0b4d188594ed45c2feb7da2755b3876d5e14a784d4e9d5c5d449054c1d63035

    SHA512

    ac642588328756df133201adb0de4b10af324db4c22e14e3342ff687c51d2d9c7c37183d43d371fb566ba43d1c7a85e92aa82972b204c1afe9756264b8bc5cdd

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-3350944739-639801879-157714471-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    cea12e3220f28f943c2e874e46bb6906

    SHA1

    236280bf91f81159ec4f0852f823a4ef9c73e391

    SHA256

    b5e2483888f1d18bb7f28e9f26ac371ebe58d3c99eabfd2db192bf12a4ca5f00

    SHA512

    d35673890cfb18cb8e8200a715bc87ca11561ca70bfefb097eef38cd1f69d86109a594d6da99353dae2a04a989d128203ee1a335f808d74f7b2ddbc7b550aebe

    Download Submit

  • memory/2172-2796-0x0000000002EF0000-0x0000000002F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2172-2-0x0000000002EF0000-0x0000000002F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2172-2790-0x0000000002EF0000-0x0000000002F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2172-2791-0x0000000002EF0000-0x0000000002F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2172-0-0x0000000002EF0000-0x0000000002F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2172-1-0x0000000002EF0000-0x0000000002F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4532-2798-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4532-2797-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4532-2799-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4532-2828-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4532-2829-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB

    Download