Overview

overview

10

Static

static

10

2025-01-28...de.exe

windows7-x64

9

2025-01-28...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28-01-2025 16:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-28_dbd1e940cb5d2d3ded216a7a55e43d85_darkside.exe

  • Size

    146KB

  • MD5

    dbd1e940cb5d2d3ded216a7a55e43d85

  • SHA1

    833e046616354a1c9d260aec6cd40d8477ab1012

  • SHA256

    e7df8e3297b3daa23d6633c9a87db2f05be14a0e45338bc3ff170f934cec6dd8

  • SHA512

    166d04c074f8ec6241ac04434a8ea473ab855b6aeca3c9b438147451315b582dd2572399c18335e053ebc20e9f65c43f6b6ba3018aa330c6ec334d6b6b0baad6

  • SSDEEP

    1536:ZzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD6mZlyPvJfHTbM8myFolkNstUyz:iqJogYkcSNm9V7D6mZl2vJ/8zlastT

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (341) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-28_dbd1e940cb5d2d3ded216a7a55e43d85_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-28_dbd1e940cb5d2d3ded216a7a55e43d85_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\ProgramData\B8E3.tmp
      "C:\ProgramData\B8E3.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B8E3.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1192
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x148
    1⤵
      PID:2780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\CCCCCCCCCCC
      Filesize

      129B

      MD5

      9de414f03b960c49164ee526e478dd81

      SHA1

      9ce283e02bef529526db8bccf196565a71a93a0a

      SHA256

      1bd3dcb08dbb95576cee3fcb59a369d2fc29d65fef0540cd61cf1ecc0f5c464b

      SHA512

      6e668fc222ffe4992b17d81e352e03446ae50dfcfee9a9ede5b893f6d2dba14cb928729a40f38a86f261b79e1876fcf3a519cf2444eff8de7d38fcebdfc1f628

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      146KB

      MD5

      20f5adcafe5eebdb7c1c6b38178f44c0

      SHA1

      8866d1e5a1f0f093b309a2bae5eeb4fbd91798a5

      SHA256

      1843502a34098ee11882e7a1416ae520cd1385bc265a959c45849e1a1edfbec7

      SHA512

      4a669a924c0ff2586cfcc86190512a55f2b712698318ab802125a1750db07f37bee202a4678c39ef8a0639e00f27a2f854d08ef6e41243b42703bf53b74fc125

      Download Submit

    • C:\V2li97crf.README.txt
      Filesize

      883B

      MD5

      0ccc05c707a4280f18a9cde2190a1f9c

      SHA1

      46b2059e639f751645dad047a8abc09448985371

      SHA256

      434e3d973e9bbf5f8e7e83ecde40426ff6047b1715eadbd62a03c8c97736c323

      SHA512

      e9ba9895ad5fbcd30980d0bfa3e73b49f797f46ab207f25dff543c696dcb027241797b9fbfe092fdab902d7662ee2d0b0a279b2a7feb372727dfc228420576a7

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      78891fb313ca51d788f2b9f6802a6345

      SHA1

      9c29f438e19c54c60003a8da7b87b2ffa170c3a0

      SHA256

      a281cfd6cbfa1f86f5353aa9e9deedb12f915fa7462d9b3720f06c256be87093

      SHA512

      5d06908dd25d34c3fb25b9f53f1811c06db21b0bac4e59956df1e0b16828dd0b9a5eab97441ff7340f74d97ecd638b4344b37a90b3644975aff9fdea3ddcebab

      Download Submit

    • \ProgramData\B8E3.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/648-874-0x0000000000401000-0x0000000000404000-memory.dmp

      Filesize

      12KB

      Download

    • memory/648-875-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/648-877-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/3020-0-0x00000000021A0000-0x00000000021E0000-memory.dmp

      Filesize

      256KB

      Download