Overview

overview

10

Static

static

10

2025-01-31...de.exe

windows7-x64

10

2025-01-31...de.exe

windows10-2004-x64

10

Resubmissions

31-01-2025 10:07

250131-l5mpmsvldj 10

31-01-2025 09:38

250131-lmgexasjfw 10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    31-01-2025 10:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-31_ab877999ca6168fd099040f98a64edc6_darkside.exe

  • Size

    147KB

  • MD5

    ab877999ca6168fd099040f98a64edc6

  • SHA1

    c530d7246fb5a00d09ed53c84e6ed1513af929ad

  • SHA256

    e5aca3c506667dc2b0a0f35c8597fd6f80c3ee852a88400f0f7f727ae8666295

  • SHA512

    a5431e6519c46d451c5224c289978da04e3c84ffdbc79203fe8f70850629a55b3a493dfec493c1588d73963944cb42bacb05780bafc41a08383b5fe5bf9d6e88

  • SSDEEP

    3072:Z6glyuxE4GsUPnliByocWepajomS/nF4pxmI:Z6gDBGpvEByocWe+dOF

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\RDYzae88l.README.txt

Ransom Note
YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: 459BD77854ECFD7281D4372FEA64DC13 Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2025 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Signatures

  • Renames multiple (327) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-31_ab877999ca6168fd099040f98a64edc6_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-31_ab877999ca6168fd099040f98a64edc6_darkside.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\ProgramData\BC1E.tmp
      "C:\ProgramData\BC1E.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BC1E.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1972
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\DisableLimit.kix.RDYzae88l
    1⤵
    • Modifies registry class
    PID:3040
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:3056
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:912
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\RDYzae88l.README.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:2240
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x14c
        1⤵
          PID:800

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini
          Filesize

          129B

          MD5

          a272d432570aa6643d9bbceb8d92e5b5

          SHA1

          2d26c827c41dc02098b4ff73d41821c0ce92badd

          SHA256

          6b5ed88fb082a91250bf2b7b6d8ab8c959c6acb004ab2bba4f684ff4428a2e26

          SHA512

          a7dfe9e19400c7c1cbb179fecec90ef8435a4d16c753a0babdfbc88554cd8e79d39f9a7622775cd379700d1f1fab6c251df95f374c1697cabdf0c4f86c2bfa11

          Download Submit

        • C:\ProgramData\BC1E.tmp
          Filesize

          14KB

          MD5

          294e9f64cb1642dd89229fff0592856b

          SHA1

          97b148c27f3da29ba7b18d6aee8a0db9102f47c9

          SHA256

          917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

          SHA512

          b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

          Download Submit

        • C:\RDYzae88l.README.txt
          Filesize

          1KB

          MD5

          d19c0ed25c083addb7ffd7fa41ee4838

          SHA1

          3c20a9fac06f549416c10f9fcc6c4bf976a7a3b9

          SHA256

          571a7d246c9dcaf4335e5f698c5a8bd8f06358a8617bbd5dd44f29c47ef32f36

          SHA512

          6c7594b7263f85437cc2df295bed006cd028dd31a1b106c7b1a0757677060c804e2dcf37b3ee48ebf81d79bfc848d7dafdd215f80b276e4f97ebdd2200a5a8dc

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
          Filesize

          147KB

          MD5

          f5e904aa35f9e5740ba589eee1593d77

          SHA1

          18c18590dda091f1ce22ad4d34628b0c7ef3a6cc

          SHA256

          de949a28996bcb3a9090e48814e48acf2076ed99919b6274bb5e51951d8aea2a

          SHA512

          9b46c9d61f6ab7ecf2e436e8ac194a9ea95cf13a0a1cdaa7b36ffaa166c30ba4c8cbabf708f4a77b9a2565437a8c0c1fb6f982ee88d796d8e687b41e561e487c

          Download Submit

        • F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\GGGGGGGGGGG
          Filesize

          129B

          MD5

          a06d0af27164ef1ec4f7af480500878b

          SHA1

          dc3f9b53e0925394653429ba7d5e9a0fe1e9f5f0

          SHA256

          1877d1dd4bbc1f1472f3bb40ee844d1ad0f33eb28dd957094d86c4c02445e001

          SHA512

          f7d14bd124f7aaa4fa426aa6ac7248bc4dc1819c8623bb00c9f092e0db5e41d891eddfd9129e590c578da4f338447f35c98c25b8efed2162f199fe900e11615f

          Download Submit

        • memory/1680-858-0x000000007EF20000-0x000000007EF21000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1680-857-0x000000007EF80000-0x000000007EF81000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1680-856-0x0000000000770000-0x00000000007B0000-memory.dmp

          Filesize

          256KB

          Download

        • memory/1680-854-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1680-855-0x0000000000770000-0x00000000007B0000-memory.dmp

          Filesize

          256KB

          Download

        • memory/1680-888-0x000000007EF60000-0x000000007EF61000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1680-887-0x000000007EF40000-0x000000007EF41000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2616-0-0x0000000000140000-0x0000000000180000-memory.dmp

          Filesize

          256KB

          Download