File Analysis - 2023:03:23

Network indicators on this page are defanged (e.g. example[.]com) so they can't be clicked by accident.

Samples can be downloaded here

Files

darkside.zip (f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4)

SUMMARY

We retreived and analyzed multiple samples of Darkside ransomware review of samples by AhnLab[1]. We reverse engineered key components of the ransomware to gain an understanding of the malware family so we could quickly identify it in the future in the event of a successful attack. Moreover we sought to validate the findings purported by AhnLab. During our analysis we were able to identify key routines and generate Ghidra function IDs as well as validate an existing script that is able to decrypt the malware's configuration.

ANALYSIS

Darkside's entry point is easily identifiable by the three PUSH instructions followed by two CALL instructions. The first of the two CALL instructions have been renamed according to our analysis. The latter of the three is a working function that handles all the other tasks for enumerating the file system, encrypting and overwriting files, and littering the file system with ransom notes.

  entry                                       
    0040b2bd   PUSH    0x10
    0040b2bf   PUSH    DAT_00421010
    0040b2c4   PUSH    DAT_00421000
    0040b2c9   CALL    f_genKeyBuffer           ; renamed by us
    0040b2ce   CALL    f_getEntryPoint&PEB  ; renamed by us
    0040b2d3   CALL    FUN_0040a0cd
    0040b2d8   PUSH    0x0                
    0040b2da   CALL    dword ptr [->KERNEL32.DLL::ExitProcess]

The CALL at 0x0040b2c9 takes two 16-byte arrays, "edf9e5ed8640fd53ab185838646bd9df" and "92b2801a9c19867db6a5002936c1084a", and the value 16 to create a key from a custom key generation algorithm. The Third argument (int 16) is used as a counter in the key generation routine. (Analyst note: These keys are located in an ".ndata" section of the PE file and this is a trivial indication that the sample is a Darkside ransomware sample. In three samples we investigated, the two 16-byte arrays were the same value. It is unclear if different values were distributed to affiliates).

The function f_genKeyBuffer() (renamed by us) has some unique functions that make it an ideal candidate for binary signature patterns and Ghidra function IDs. We do not discuss the properties of the function here, but the important takeaway is that the loop at 0x0040b067 through 0x0040b090 builds a 256-byte scambled array that starts at address 0x410050 by shuffling the array b'edf9e5ed8640fd53ab185838646bd9dfb in 4-byte chunks and performing arithmetic operations on those chunks. The second loop starting at 0x0040b09e scrambles the 256-byte array using byte values from the second argument passed to the function, the array b'92b2801a9c19867db6a5002936c1084a'. These two loops are an easy way to identify the sample, as they appear relatively early withing execution, and are unique. See the appendix (Figure B) for a decompiled example of the two loops.

After `f_genKeyBuffer()` is executed the entry function walks the PEB to set up the stack for proper execution of the following function located at 0x0040a0cd` and called from `0x0040b2d3`. This function contains many subroutines. This function contains a parent function to resolve APIs dynamically using a unique hashing routine and two hard-coded values for `LoadLibraryA()` and `GetProcAddress()`. Ultimately, these are resolved in the following manner from the parent's perspective:

  f_resolve_APIs
    00401943   PUSH    EBX
    00401944   PUSH    ECX
    00401945   PUSH    EDX
    00401946   PUSH    ESI
    00401947   PUSH    EDI
    00401948   PUSH    0x1e2b04a4
    0040194d   PUSH    0x3b98045e                ; LoadLibraryA
    00401952   CALL    f_getmodule+api
    00401957   MOV     [LoadLibraryA], EAX       ; &LoadLibraryA
    0040195c   PUSH    0x288b0588
    00401961   PUSH    0x3b98045e                ; GetProcAddress
    00401966   CALL    f_getmodule+api
    0040196b   MOV     [GetProcAddress], EAX     ; &GetProcAddress
    00401970   MOV     ESI, CT_APIs_0040d00c     ; = 06h
    00401975   MOV     EBX, 0x2e                 ; decryption indexer
    0040197a   MOV     EDI, &RtlAllocateHeap     ;
    0040197f   CALL    FUN_004018d9              ; decypt other APIs

After LoadLibraryA and GetProcAddress have been resolved, the routine FUN_004018d9 at 0x0040197f is called 16 times, and takes and index argument to decrypt data from 0x0040d00c.

CONCLUSION

As of March 2023, the scripts supplied by OpenAnalysis[2] still work to decrypt the Darkside ransomware config data. We have modified and refactored these scripts into one indpendent script for ease of use and tested on Python 3.9.7 in our test environment. Before executing the script to decrypt the configfuration file, the analyst must edit the absolute path to the binary in the RANSOMWARE_FILE variable. The analyst should also verify the key information is correct per this report in the KEY_BUFFER variable. See Appendix A below for example usage and output.

We were unable to determine any additional functionality of Darkside as purported by AhnLab[1] and reported by Threat Intelligence. After analysis of the sample and further investigation from Threat Intelligence, we suspect the claims by AhnLab in their post are founded more on product advertisement and not on reality of the threat landscape. We have arrived at this conclusion because we were unable to retrieve any samples that resembled Darkside but differed significantly in their attack vectors or obfuscation mechanisms, and because AhnLab did not provide a sample or hash reference from their analysis.

REFERENCES

APPENDIX

Figure A:

C:\Users\user\Desktop\>python dark-decrypt.py
    Affiliate ID: b'0607b8382472634'

    b'$recycle.bin | config.msi | $windows.~bt | $windows.~ws | windows | appdata | application data | boot | google | mozilla | program files | program files (x86) | programdata | system volume information | tor browser | windows.old | intel | msocache | perflogs | x64dbg | public | all users | default |  | '

    b'autorun.inf | boot.ini | bootfont.bin | bootsect.bak | desktop.ini | iconcache.db | ntldr | ntuser.dat | ntuser.dat.log | ntuser.ini | thumbs.db |  | '

    b'386 | adv | ani | bat | bin | cab | cmd | com | cpl | cur | deskthemepack | diagcab | diagcfg | diagpkg | dll | drv | exe | hlp | icl | icns | ico | ics | idx | ldf | lnk | mod | mpa | msc | msp | msstyles | msu | nls | nomedia | ocx | prf | ps1 | rom | rtp | scr | shs | spl | sys | theme | themepack | wpx | lock | key | hta | msi | pdb |  | '

    b'backup |  | '

    b'sql | sqlite |  | '

    b'vmcompute.exe | vmms.exe | vmwp.exe | svchost.exe | TeamViewer.exe | explorer.exe |  | '

    b'sql | oracle | ocssd | dbsnmp | synctime | agntsvc | isqlplussvc | xfssvccon | mydesktopservice | ocautoupds | encsvc | firefox | tbirdconfig | mydesktopqos | ocomm | dbeng50 | sqbcoreservice | excel | infopath | msaccess | mspub | onenote | outlook | powerpnt | steam | thebat | thunderbird | visio | winword | wordpad | notepad |  | '

    b'vss | sql | svc$ | memtas | mepocs | sophos | veeam | backup | GxVss | GxBlr | GxFWD | GxCVD | GxCIMgr |  | '

    b'baroquetees[.]com | rumahsia[.]com |  | '

    b'Welcome to DarkSide! \r\n  \r\n All Your Files Are Encrypted! \r\n  \r\n Find %s And Follow Instructions! |  | '

    b'----------- [ Welcome to DarkSide ] -------------> \r\n  \r\n What happend? \r\n ---------------------------------------------- \r\n Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. \r\n But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. \r\n Follow our instructions below and you will recover all your data. \r\n  \r\n Data leak \r\n ---------------------------------------------- \r\n First of all we have downloaded more then 500GB data from your network. \r\n  \r\n Included: \r\n -Accounting data \r\n -Finance data \r\n -HR \r\n -Employees confidential data(photos, benefits, taxes, etc) \r\n -Marketing \r\n -Budgets \r\n -Taxes(sales tax compliance, property, income and franchise taxes, etc) \r\n -Payrolls \r\n -Banking data \r\n -Arbitration \r\n -Scans \r\n -Insurance \r\n -Reconciliations \r\n -Reports(monthly bank inventory, monthly financial, claims reports, etc) \r\n -Audits(DHG, insurance audits, etc) \r\n -B2B clients config data \r\n -Confidentiality 2020 \r\n -2020, 2021 Business plans \r\n -2019, 2020, 2021 years Closing (full dumps) \r\n -and a lot of other sensitive data \r\n  \r\n Your personal leak page: hxxp://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id[.]onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q \r\n On the page you will find examples of files that have been downloaded. \r\n The data is preloaded and will be automatically published if you do not pay. \r\n After publication, your data will be available for at least 6 months on our tor cdn servers. \r\n  \r\n We are ready: \r\n - To provide you the evidence of stolen data \r\n - To delete all the stolen data. \r\n  \r\n  \r\n What guarantees? \r\n ---------------------------------------------- \r\n We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. \r\n All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. \r\n We guarantee to decrypt one file for free. Go to the site and contact us. \r\n  \r\n How to get access on website?  \r\n ---------------------------------------------- \r\n Using a TOR browser: \r\n 1) Download and install TOR browser from this site: hxxps://torproject[.]org/ \r\n 2) Open our website: hxxp://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd[.]onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM \r\n  \r\n When you open our website, put the following data in the input form: \r\n Key: \r\n  \r\n ug8lgpX3WrFzlEJ6HBWlwJnf7jemhfnlxBw9porj1uuYFTgKbxJQJLYiteQS7DwgZn7dH0fs7qPPWmZ6inPv5GTmSJZNAjGLVIjd4SoiyTdGyophf0zPBxx6uEAOJxM0Woo4ZGeKVoUDHtZsqZNnhMF7aPh54VnKpIJXiZDbZZw4P06xTuw1UMeiTE7wdg7HWZMepAVTzEI2W04RbkPFQHfUgEDcslDxbr83BvopYTYGKFRmtNUMH8OsOZQrOtv50xWDaOfbqxbzfHMJm30QGaGpgylJHQZsscz3XBnwIdvlwBJ9KN4DVgFgziRdvwJrfCP6YN1CYTOQgw1rzqmIU4G1xGYv7rE3jiBY1s4D3Y26SbppTceAVMu1mKx5CFIE3EbtcAsNtEqLHDbPnMCvU6Apwp17TXGob8xXJpEDBZhIzdTaCuybcprwcFNTOzccjbIH81W39MrcJi9mNO3kHRe5fxmIFKvc9v8aQDihGyC65DtdabyBjidXI1NyNONT4PTyrxYqgffPsNDFuzz2yMrXiTAwtAQPqny5BBJQsfVhpLXTtnLvWg1 \r\n  \r\n !!! DANGER !!! \r\n DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them.  \r\n !!! DANGER !!!'

Figure B

do {
      *(iVar4 + 0x41005c) = iVar6;
      *(iVar4 + 0x410058) = iVar2;
      *(iVar4 + 0x410054) = iVar8;
      *(&DAT_00410050 + iVar4) = iVar10;
      iVar6 = iVar6 + -0x10101010;
      iVar2 = iVar2 + -0x10101010;
      iVar8 = iVar8 + -0x10101010;
      iVar10 = iVar10 + -0x10101010;
      iVar4 = iVar4 + -0x10;
    } while (-1 < iVar4);
      uVar7 = 0;
    uVar5 = 0;
    uVar9 = 0;
    do {
      while( true ) {
        uVar7 = uVar7 + *(param_2 + uVar9) + (&DAT_00410050)[uVar5];
        uVar1 = (&DAT_00410050)[uVar7];
        uVar9 = uVar9 + 1;
        (&DAT_00410050)[uVar7] = (&DAT_00410050)[uVar5];
        (&DAT_00410050)[uVar5] = uVar1;
        if (param_3 <= uVar9) break;
        bVar3 = uVar5 + 1;
        uVar5 = bVar3;
        if (bVar3 == 0) {
          return;
        }
      }