Darkrace is a Windows-targeted ransomware with notable similarities to LockBit, employing batch-file tactics, mutex checks, and hardcoded exclusion lists to optimize encryption. It pursues a double-extortion approach, using an onion leak site and data exfiltration to pressure victims into paying.
Read more: https://blog.cyble.com/2023/06/08/unmasking-the-darkrace-ransomware-gang/
#Darkrace #LockBit #DarkraceRansomware
Read more: https://blog.cyble.com/2023/06/08/unmasking-the-darkrace-ransomware-gang/
#Darkrace #LockBit #DarkraceRansomware
Keypoints
- Darkrace targets Windows and shows multiple similarities to LockBit, including process termination via batch files and random encryption extensions.
- It uses a hardcoded mutex (CheckMutex) to prevent reinfection and gates actions based on membership in the Administrators group.
- The malware enumerates system drives and prepares file staging for encryption using GetLogicalDriveStringsW() and GetDriveTypeW().
- Darkrace deletes shadow copies, stops targeted services, and uses a looped 1.bat batch file to kill processes and facilitate encryption.
- Encryption is AES-based, with a distinctive .1352FF327 extension and icon/registry changes to mark encrypted files.
- Ransom notes reference OnionMail and a leak site, signaling a double-extortion approach; the leak site reportedly listed two victims before being taken down.
MITRE Techniques
- [T1059] Command and Scripting Interpreter – Brief description: Darkrace uses batch files to terminate processes and orchestrate actions; Quote: “Darkrace ransomware exhibits several similarities to the LockBit ransomware, including the deployment of batch files to terminate processes, the dropping of file icons, and the utilization of random encryption extensions.”
- [T1083] File and Directory Discovery – Brief description: It enumerates system drives and stages files for encryption; Quote: “enumeration of system drives and file staging for encryption. To identify the drive and file staging, the ransomware uses GetLogicalDriveStringsW() and GetDriveTypeW().”
- [T1112] Modify Registry – Brief description: Creates a registry entry to set the dropped icon as the default icon for encrypted files; Quote: “registry entry which makes dropped icon as default icon for encrypted files.”
- [T1562] Impair Defenses – Brief description: Stops multiple services (databases, backups, and system functions) to improve encryption success; Quote: “stops several services on the infected system. These targeted services are primarily associated with databases, backups, and critical system functions.”
- [T1070] Indicator Removal – Brief description: Deletes shadow copies to hinder recovery; Quote: “deletes the shadow copies of the infected system.”
- [T1490] Inhibit System Recovery – Brief description: Uses commands to remove restore points/shadow copies; Quote: “the ransomware proceeds to delete the shadow copies using two distinct commands.”
- [T1486] Data Encrypted for Impact – Brief description: Encrypts files with AES and appends a new extension; Quote: “encrypts files using the AES encryption algorithm” and “appends the extension ‘.1352FF327’ to the original file extension.”
Indicators of Compromise
- [Hash] MD5 – 1933fed76a030529b141d032c0620117 – context: Darkrace Ransomware executable
- [Hash] SHA1 – c55c60a23f5110e0b45fc02a09c4a64d3094809a – context: Darkrace Ransomware
- [Hash] SHA256 – 0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4 – context: Darkrace Ransomware
- [Hash] MD5 – cb1c423268b1373bde8a03f36f66b495 – context: Darkrace Ransomware
- [Hash] SHA256 – 74b5e2d90daaf96657e4d3d800bb20bf189bb2cf487479ea0facaf6182e0d1d3 – context: Darkrace Ransomware
- [Hash] SHA256 – 2b15e09b98bc2835a4430c4560d3f5b25011141c9efa4331f66e9a707e2a23c0 – context: 1.bat Batch file
Read more: https://blog.cyble.com/2023/06/08/unmasking-the-darkrace-ransomware-gang/