Analysis
-
max time kernel
105s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
01/04/2025, 07:30
General
-
Target
2025-04-01_943a107b88f85fd88198a9df2e1dc0dd_darkside.exe
-
Size
59KB
-
MD5
943a107b88f85fd88198a9df2e1dc0dd
-
SHA1
bfcf6050ddba6053b738e0c5e54b105880a3c45a
-
SHA256
80c75581d6e09643a8fc7d7e0fa677e95faa64f20141cf493371ea604f6a07c9
-
SHA512
bb179e1deb929502a63d37a19f34808329cb0a5f85618aafcc1eb22ecd91966f12c0033c36a84d966c84dfa86172b0af352e10a086f337f404af34256caacf77
-
SSDEEP
768:GjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvD7Y23W58:Dx7Fu4/ihrhDTV1ylbcZ58
Malware Config
Extracted
C:\Recovery\WindowsRE\README.15627029.TXT
darkside
http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT
Signatures
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Darkside family
-
Renames multiple (168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-01_943a107b88f85fd88198a9df2e1dc0dd_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-01_943a107b88f85fd88198a9df2e1dc0dd_darkside.exe"1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C DEL /F /Q C:\Users\Admin\AppData\Local\Temp\2025-0~1.EXE >> NUL2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD565494ea6831e577d82fac2b91b9c3d43
SHA15c23717d22ee9b94306f2d5a2a53c60aca03eb8c
SHA2565e98b41a51606e16dda30ad4a49457227f75d71ad2004e2942c6b8de6202c4f3
SHA51228ba13f7793ac8271af03b26eaeba6cbe707bf1f07fb1792818a6ab270d1c20d0091ef4a10c092f60c373aefe09698d2b470ec6a7f8cfa47103fd8bbb8d7a7bb
-
Filesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
Filesize
1KB
MD55d848a83a294e917ec23cd5a90f725c6
SHA1eff12f5eadedb9c136ac44b7ab9a3d86e70c6ebb
SHA2562c74d009e1eb5f43feddd00617d1451b998d4ed59d4b9396adc22126bd3281fc
SHA51256f79082ca3312b87828ad6d50cd18311d7836b553cc126f632dbb2d79b5aa8a13ef1507ba106a314b62ba08be6592102324cfc9458bf82d407c3d6076d6e0b2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB