Analysis
-
max time kernel
95s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
24/03/2025, 21:09
General
-
Target
2025-03-24_5c5286a99c4256179a8aa96f4970cf08_darkside_lockbit.exe
-
Size
156KB
-
MD5
5c5286a99c4256179a8aa96f4970cf08
-
SHA1
e3ba7868b6022cf85cbaf5f831d19d56ac957a6f
-
SHA256
1db64cb43c91ff13af7f91c29b158d22a9b3e856ec72649f31cfb233d9e59952
-
SHA512
cd275645a70135a150353b91410c226d0763389fb317a474e64cdde7e48f2c518a04f96a957b439e05d6a0fc9bf8ceaf74d47874e8255a2331720cab274e1958
-
SSDEEP
3072:gDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368nHXENxfP8tlZzKuI8W:K5d/zugZqll3b2HQbzdI
Malware Config
Extracted
C:\u9w7GGnDx.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Signatures
-
Renames multiple (142) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-24_5c5286a99c4256179a8aa96f4970cf08_darkside_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-24_5c5286a99c4256179a8aa96f4970cf08_darkside_lockbit.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\AA78.tmp"C:\ProgramData\AA78.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AA78.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5f9cc2c4a09824f466b16f5925b81431c
SHA1029bad874f3a945ab225351e14a3cce8fb6ef4cb
SHA25607ea2a124daa7ecd5c4544d4c874688fb195b4d42a6f016b447393d29d55b18e
SHA5127f48e8cfb9be9648fa34f8958e295f3e053d499944097f93a45b59124ed06a3255ea9bfb840d079c013170df77240db410e49c4ccca54b928efdc032e4d8680d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
156KB
MD5b59768f991e2759abc0d24b733245ecb
SHA1a359db546880a35222c7a4f692a0a2487f01885e
SHA256f485425ec9c9b1e56d95660e0c95bad28f6640bb5a6e75eb9dac676766dd42f1
SHA5124026d7e6cc708bdbc287972572c83c1a08a3b3e74924d7a53210f20f843f0219b02cacf51502bb882eba77a36d0a9c897b3a9a8067f4fbd445f9a8cec07ef1f6
-
Filesize
3KB
MD500931faf5be259abb005e157e41592fb
SHA1546238ec032a1ca23d07f7edb0a3a7590bdfcc7c
SHA256a13f7b525e5d72fa22a3b4d3a2bc487cc12be6c8f9657346faa469407ee5adee
SHA5122fad4507cee7492076b1a2dc9bbb9ee9b2bf124854c43606a9011a33600160b3cd9d5d3af667411265e221b84b5889e7f2c97ef0310b3bd9b9680b37b85d9ab4
-
Filesize
129B
MD581f0ceab36560d1910606efde268b68f
SHA12c1f22eb0b599cb01bd5093ec79be11ae7d45a84
SHA2564513c4771e71cacfa5193d95119fc9546fcecc09a746484166aef8d7fd2e0254
SHA51297dec89a3f5b29490f7dd5a05b0927c7cb160a43e7079c3cb19180bd0a0397b0c45843fcf1dfb0b7c9037ced4cea0e5c2986d65d2a284841150df0fc13d063c6
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB