Analysis
-
max time kernel
140s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
24/03/2025, 20:53
General
-
Target
2025-03-24_5c5286a99c4256179a8aa96f4970cf08_darkside_lockbit.exe
-
Size
156KB
-
MD5
5c5286a99c4256179a8aa96f4970cf08
-
SHA1
e3ba7868b6022cf85cbaf5f831d19d56ac957a6f
-
SHA256
1db64cb43c91ff13af7f91c29b158d22a9b3e856ec72649f31cfb233d9e59952
-
SHA512
cd275645a70135a150353b91410c226d0763389fb317a474e64cdde7e48f2c518a04f96a957b439e05d6a0fc9bf8ceaf74d47874e8255a2331720cab274e1958
-
SSDEEP
3072:gDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368nHXENxfP8tlZzKuI8W:K5d/zugZqll3b2HQbzdI
Malware Config
Extracted
C:\Users\u9w7GGnDx.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Signatures
-
Renames multiple (163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-24_5c5286a99c4256179a8aa96f4970cf08_darkside_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-24_5c5286a99c4256179a8aa96f4970cf08_darkside_lockbit.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\C66D.tmp"C:\ProgramData\C66D.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C66D.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a3ea96dad36207bc5498d4bf019dffe3
SHA1d5ca38885d7b100779b2f4f826e6091096e9eb82
SHA256ba603fb6a638597ad539bff2e9704b1ac88d122dfb736c3d32546780935c8f45
SHA512eab6e2bcee7b5ed62e26f6cd3e6e053bff5580f2c66f4388d139240a7019a49fcacbeebe3bb575b63377e04bb21d67ed91eba33209397aa0196e2e3bacf65f6e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
156KB
MD508356414aeabee3742088728f7bbc62b
SHA1f1d375341d576477744e7b79b2020423980644e4
SHA2566b07f89609a04bb9387f88a2a6971a357a1918371b45db294a57ebb2470b9603
SHA5129aed4e815d92412b4633d3d38504a5e1285a1034c4d882877cda702cd145a59ddffa5d46b7fb9321ebdfd52fb3993fb43ae84485b9242ae9452ac901bbfe936a
-
Filesize
3KB
MD5036f3984d8509e1af0cd43b41b7665a6
SHA19c661241909cf1861511cb585a5ef6b4d8e48eb3
SHA256e59fd578ae2da495d0255801e087bb8c5740473eaebd5b2da61f5a5094909f3a
SHA5123a599fda30c924363e7b977597c4e32052c39b32eaea7815140c6d63bd6a297c7db75b9bf93e7c91e81139996c1768746315ff03673c6a48ea640f4b90feb1d8
-
Filesize
129B
MD5121d950c66acc787b638e31299b0ed5b
SHA1a3e8f75e3323f6146aba607f6dd3b5f72b24bf4c
SHA2566fb8cd340fee5ce79a45e52b213e24fd4a398faf504e513e215c0c7c7243dc27
SHA512f67f6f603f69ea61618f4f0a40b75b3df4c129629c8ec486a45f92deedb54088e0da41da83b51c738f3d58a429a87076351dacfbf0daa7798b383172b5623f57
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB