Analysis
-
max time kernel
140s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/06/2023, 02:40
Behavioral task
behavioral1
Sample
2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe
-
Size
200KB
-
MD5
da44b75688848eaad3b888d4ffa3eb8a
-
SHA1
1e18f8d613b31426bf7c3cad82ecee94e94f4fdb
-
SHA256
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f
-
SHA512
ee19553d7816dc82dac7dd7bc7e9f05e9360074e7870e032da02f12bc29f2487085bc89aadb8712c687f1f844361eab18c09a92b965eb96c0c14491e630411f2
-
SSDEEP
3072:sr85Cua1U197bzhVsmftsZzSY2h1OSzlezR9P32euJ9OlKolb:k9Ri1dNVsmfte2Y2hvMX32eufj0b
Malware Config
Extracted
C:\sdBuuG2px.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Detect Neshta payload 11 IoCs
resource yara_rule behavioral1/files/0x0001000000010323-67.dat family_neshta behavioral1/memory/1308-403-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-442-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-447-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-448-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-451-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-452-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-454-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-455-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-457-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-459-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Rule to detect Lockbit 3.0 ransomware Windows payload 5 IoCs
resource yara_rule behavioral1/files/0x00090000000133da-56.dat family_lockbit behavioral1/files/0x00090000000133da-58.dat family_lockbit behavioral1/files/0x00090000000133da-60.dat family_lockbit behavioral1/files/0x00090000000133da-61.dat family_lockbit behavioral1/files/0x00090000000133da-412.dat family_lockbit -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConfirmRead.tiff 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\Users\Admin\Pictures\RestoreExit.tiff 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\Users\Admin\Pictures\UnregisterComplete.tiff 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Executes dropped EXE 2 IoCs
pid Process 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 2028 519A.tmp -
Loads dropped DLL 4 IoCs
pid Process 1308 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 1308 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 1308 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\desktop.ini 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\sdBuuG2px.bmp" 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\sdBuuG2px.bmp" 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 2028 519A.tmp 2028 519A.tmp 2028 519A.tmp 2028 519A.tmp 2028 519A.tmp 2028 519A.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\Desktop 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\Desktop\WallpaperStyle = "10" 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px\DefaultIcon\ = "C:\\ProgramData\\sdBuuG2px.ico" 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sdBuuG2px 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sdBuuG2px\ = "sdBuuG2px" 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px\DefaultIcon 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeDebugPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: 36 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeImpersonatePrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeIncBasePriorityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeIncreaseQuotaPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: 33 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeManageVolumePrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeProfSingleProcessPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeRestorePrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSystemProfilePrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeTakeOwnershipPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeShutdownPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeDebugPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeBackupPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe Token: SeSecurityPrivilege 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1308 wrote to memory of 912 1308 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 28 PID 1308 wrote to memory of 912 1308 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 28 PID 1308 wrote to memory of 912 1308 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 28 PID 1308 wrote to memory of 912 1308 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 28 PID 912 wrote to memory of 2028 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 31 PID 912 wrote to memory of 2028 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 31 PID 912 wrote to memory of 2028 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 31 PID 912 wrote to memory of 2028 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 31 PID 912 wrote to memory of 2028 912 2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe"C:\Users\Admin\AppData\Local\Temp\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe"2⤵
- Modifies extensions of user files
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\ProgramData\519A.tmp"C:\ProgramData\519A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2028
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
129B
MD5d7fbb704f6560af1f07802c11bfdb452
SHA1839cdc2ed26e12cf29c059bcd7cf3ab764b65671
SHA256e708d5c25f59742cba9d1d47569b43d55f30a3a4526365e3e33bc693b355535d
SHA5127c3c92bb61398c9242920002f66c6b61fda20fdf4df2c577e53322c9566f921209d33a740e5213068fd6e6c37cffb936e3268b10b03edfeff2867cef732ab2f8
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe
Filesize159KB
MD599bcce4f1d96c6ef25c157c9762d7fba
SHA185125f8f6ddc5dddca55c3c162eadffc7c10c231
SHA2562e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9
SHA512aa31d760be90faf8c2cad5901cdd7ca609f97d327f1c3660af661a43f77e865f5380fa1743969a10642ac4ba4219244d6890a70b4594ff260b34fb71a3518e47
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe
Filesize159KB
MD599bcce4f1d96c6ef25c157c9762d7fba
SHA185125f8f6ddc5dddca55c3c162eadffc7c10c231
SHA2562e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9
SHA512aa31d760be90faf8c2cad5901cdd7ca609f97d327f1c3660af661a43f77e865f5380fa1743969a10642ac4ba4219244d6890a70b4594ff260b34fb71a3518e47
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe
Filesize159KB
MD599bcce4f1d96c6ef25c157c9762d7fba
SHA185125f8f6ddc5dddca55c3c162eadffc7c10c231
SHA2562e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9
SHA512aa31d760be90faf8c2cad5901cdd7ca609f97d327f1c3660af661a43f77e865f5380fa1743969a10642ac4ba4219244d6890a70b4594ff260b34fb71a3518e47
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize159KB
MD50e8610657ad901baf1e510b53235b06c
SHA1f3b0fe40a8b9b733320dd879ad39439cf844ed6e
SHA2568e317e4c427788e2c66f239499c400834d0f677248c3eb335cbd3a346074126c
SHA51212e3e0079fb3358c55a919d5dbe70e1d7bd44d42c47d962640ff7e2eac66f72bd8310d768669cc97b4d2972331cd69fc407e469ea8c5670501afd321ca095f40
-
Filesize
10KB
MD5558614baa7b3a165df6991d7f4d5ad38
SHA1ddf8d76a4a37ecf9b641a7e149626a114c356790
SHA256a5dcbf57457a666e99210bd6f54d89016d929a5f1bf67dda60203f122879c5f3
SHA512396ed7065087c33604910e8fe6699a0e11be4a1b95390217ad32fc505324cddb440f02d04eb5b29d1b3f146bf79c02072ddc6fbc3eabba2f89cf64daa6bbd345
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
\Users\Admin\AppData\Local\Temp\3582-490\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe
Filesize159KB
MD599bcce4f1d96c6ef25c157c9762d7fba
SHA185125f8f6ddc5dddca55c3c162eadffc7c10c231
SHA2562e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9
SHA512aa31d760be90faf8c2cad5901cdd7ca609f97d327f1c3660af661a43f77e865f5380fa1743969a10642ac4ba4219244d6890a70b4594ff260b34fb71a3518e47
-
\Users\Admin\AppData\Local\Temp\3582-490\2023-05-30_da44b75688848eaad3b888d4ffa3eb8a_darkside_neshta.exe
Filesize159KB
MD599bcce4f1d96c6ef25c157c9762d7fba
SHA185125f8f6ddc5dddca55c3c162eadffc7c10c231
SHA2562e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9
SHA512aa31d760be90faf8c2cad5901cdd7ca609f97d327f1c3660af661a43f77e865f5380fa1743969a10642ac4ba4219244d6890a70b4594ff260b34fb71a3518e47