DarkSide Ransomware With Self-Propagating Feature in AD Environments

In order to evade analysis and sandbox detection, DarkSide ransomware only operates when the loader and data file are both present. The loader with the name “msupdate64.exe” reads the “config.ini” data file within the same path that contains the encoded ransomware and runs the ransomware on the memory area of a normal process. The ransomware is structured to only operate when a specific argument matches. It will then register itself to the task scheduler and run itself periodically.

The following are the features of DarkSide ransomware.

1) Ransomware Encryption Target Exception List
After being injected into a normal process, the ransomware encrypts all files aside from those with certain folder and file names. Table 1 and 2 contains the folder paths and filenames excluded from the encryption.

2) Force Terminate Running Processes
The ransomware terminates running processes in order to prevent file-handling conflicts during the encryption process. The following is a list of those targets.

3) Service Termination Targets
The ransomware closes backups and services related to AV products. Table 4 is a list of such targets.

4) Delete Volume Shadows, Suspend Windows Event Logging, and Deactivate Windows Recovery

The threat actor uses tools such as vssadmin.exe to perform acts like deleting volume shadow copies, but they manage to bypass command line-based behavior detection by using the following method.
Each process is run in SUSPEND mode, but garbage values like “11111111” are given as command line arguments. Afterward, the address of the command line is obtained by reading the PEB from the corresponding process memory and finding the RTL_USER_PROCESS_PARAMETERS struct.
Finally, by using WriteProcessMemory() to rewrite the actual command line argument in the obtained address, tools like vssadmin.exe can perform normally by using the newly transmitted argument.

The AhnLab EDR/MDS line of products considers executions like the ones above as abnormal executions. MDS products can also check the data that’s written on target process memories.

5) Ransom Note and File Encryption Extension
The ransomware generates a ransom note file called “_r_e_a_d_m_e.txt”, like the one shown in Figure 7, in each encrypted folder.

Additionally, the ransomware changes the extension format of encrypted files to “.s1s2s3[number of encrypted files]”.
 
6) Self-deleting Ransomware
After the ransomware finishes its actions, it attempts to delete itself through the following command.

Internal Propagation (Ransomware Distribution Method Through Domain Controller)

When this ransomware becomes active on the domain controller of an AD server, it creates a group policy as shown in Figure 9 to distribute the ransomware to other PCs linked to the current domain.

Table 8 shows a file-related group policy which gives the command to copy the executable file within the ransomware’s domain controller to the desktops of infected PCs with the name format “[Distribution Date]_[Ransomware Filename].exe”.

DarkSide will not operate if a certain argument to prevent replication and analysis does not match. However, as shown in Figure 10, AhnLab EDR detects ransomware strains generated through group policies in AD environments. It is also possible to check the arguments at the point of execution.

For continuous propagation, the ransomware distributes group policies with the following command.

The threat actor that performs an ATP attack on the AD environments of companies for monetary gain distributes their malware after checking the detection of all AV products based on existing signatures.

As shown in the above Figure 13, there is a great chance that DarkSide ransomware can evade being detected by AV products based on existing signatures since it cannot be collected by even VirusTotal.

The importance of an APT detection solution like MDS and EDR, which records and reports all suspicious behaviors in endpoints, becomes clear when it comes to trying to detect this threat effectively.

DarkSide ransomware attacks correspond to the following techniques in the MITRE ATT&CK framework.

• T1486 Data Encrypted for Impact^[1]
• T1484.001 Domain Policy Modification: Group Policy Modification^[2]
• T1053.005 Scheduled Task/Job: Scheduled Task^[3]
• T1562.001 Impair Defenses: Disable or Modify Tools or T1489 Service Stop^[4]
• T1489 Service Stop^[5]
• T1021.002 Remote Services: SMB/Windows Admin Shares^[6]
• T1562.001 Impair Defenses: Disable or Modify Tools^[7]

Subscribe to AhnLab’s next-generation threat intelligence platform ‘AhnLab TIP’ to check related IOC and detailed analysis information.