Overview

overview

10

Static

static

10

2025-03-25...it.exe

windows7-x64

10

2025-03-25...it.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2025, 08:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-25_9c538ff5f541f0e8b9b2cc8386b40c65_darkside_lockbit.exe

  • Size

    146KB

  • MD5

    9c538ff5f541f0e8b9b2cc8386b40c65

  • SHA1

    689fcc9c3a30efe6ff5bee231506bf3c4637e6e8

  • SHA256

    90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2

  • SHA512

    1367c402cab5e89d6863f9dad5faf497d7e15a8ce9a0644c314f523d2435f95286048ef4d87c65096a024c6f4a299049f15d863c30054ef666fa053102c25122

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS7:V6gDBGpvEByocWeauV2gvzwUg

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3C5C4A2A71C8784439 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

  • Renames multiple (675) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-25_9c538ff5f541f0e8b9b2cc8386b40c65_darkside_lockbit.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-25_9c538ff5f541f0e8b9b2cc8386b40c65_darkside_lockbit.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3684
    • C:\ProgramData\A3F2.tmp
      "C:\ProgramData\A3F2.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A3F2.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5900
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:3544
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1E58E8DF-6F6B-4F6A-9CA9-D823EA68D121}.xps" 133873644574420000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:4224

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-308834014-1004923324-1191300197-1000\CCCCCCCCCCC
      Filesize

      129B

      MD5

      755652ec36c3fc896632c8514ae7cd17

      SHA1

      9157075ff8773babae1b4ce7fef42b4f0ace9a08

      SHA256

      219398bf8d05b3bd69fc75ac9cb9c7a0732be5e73ce8150c8155ba1d9db670f0

      SHA512

      fafad2522fb6b0040346fa11efd9c7d9daedbe9d47c12d746885d13ac07745dd106467fcf5dc18f6fef65dc6991c898b42a956efab8920cdd954dda54e941f59

      Download Submit

    • C:\7V7uPExzv.README.txt
      Filesize

      1KB

      MD5

      8d1c42ec54f0a4ebc5312306eb26ba4a

      SHA1

      47fa8773c7f7fd8f9bfd61cc4ac6307f72be0bdf

      SHA256

      4bafa2a5d968f2d49deb905fcd39ed3691f12fb5a94cbf77acfa9d05c8d788ea

      SHA512

      d309219e8ddd7017e656228e810ccb050848a5ac11919d0b6e32d5185f5d178327b0fcd4fd33d43695ed2d1f3e85c842f52abb66659ba6de67d7baed8e88b558

      Download Submit

    • C:\ProgramData\A3F2.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
      Filesize

      146KB

      MD5

      ad060b9796eafe6d3135cebeffe86d29

      SHA1

      416823d334a20695290d14110b5cdae601ee4842

      SHA256

      1bfc3107452eb6dcae884bfbc3be38502d5e7811b37326f8ad4f8532b2d48d79

      SHA512

      747baa27ecb340b9fc934821bf6f7fac4bf21dab2de07ba374846e068fe292cd774431c8d71c7d91e2078e471662a581a26e8c1f0e1a1e28c116593d5bf61a08

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      ac399186cdd4e6a4d9c359ab381e34ee

      SHA1

      663c68eab5f1dccb9a60db3fc703229696f1f5af

      SHA256

      e792d68fd02504b12a77c0ea8072ce295f9f52758c14fa5c7ac24cf44e66d0f5

      SHA512

      fa5776ef4c95d3473c5606370004ab78577c77bafb5a79e930cd6fe11575fb7efb7fd4c8a8786fe536b611bd69d6faae1e3b7c7e0f4b0c90ab927b1d5348e2e6

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-308834014-1004923324-1191300197-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      3eda3ecfcfd700436a57747ece54421a

      SHA1

      2c6e792012199a5adeca7d008a0f14498ef5114d

      SHA256

      7ba8084b621a3ee32b02ab8cbdbd0c46dc1403fb4c742a0b22f09958fcb1f36e

      SHA512

      b306338433701d82fde88315f84fdc39ae42760142c379237807dbd35bfab0d3d3a5c8043d0e34c90e9dae649d8e77fe791f0cad1526957616306e0c2bfaf0e2

      Download Submit

    • memory/4064-3578-0x0000000001390000-0x00000000013A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4064-3579-0x0000000001390000-0x00000000013A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4064-0-0x0000000001390000-0x00000000013A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4064-3577-0x0000000001390000-0x00000000013A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4064-2-0x0000000001390000-0x00000000013A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4064-1-0x0000000001390000-0x00000000013A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4224-3597-0x00007FFE551B0000-0x00007FFE551C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4224-3596-0x00007FFE551B0000-0x00007FFE551C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4224-3598-0x00007FFE551B0000-0x00007FFE551C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4224-3599-0x00007FFE551B0000-0x00007FFE551C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4224-3594-0x00007FFE551B0000-0x00007FFE551C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4224-3628-0x00007FFE52C20000-0x00007FFE52C30000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4224-3629-0x00007FFE52C20000-0x00007FFE52C30000-memory.dmp

      Filesize

      64KB

      Download