Malware Analysis Report

2024-11-30 11:41

Sample ID 240215-n3myqsga86
Target 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside
SHA256 71895d170c7578dc8d5dba7e3136e514d8c42f502e5dc88aff532f11dac01f32
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71895d170c7578dc8d5dba7e3136e514d8c42f502e5dc88aff532f11dac01f32

Threat Level: Known bad

The file 2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Modifies Control Panel

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-15 11:55

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-15 11:55

Reported

2024-02-15 11:58

Platform

win7-20231215-en

Max time kernel

119s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\61BF.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2444714103-3190537498-3629098939-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2444714103-3190537498-3629098939-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\aPj8kPbya.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\aPj8kPbya.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\61BF.tmp N/A
N/A N/A C:\ProgramData\61BF.tmp N/A
N/A N/A C:\ProgramData\61BF.tmp N/A
N/A N/A C:\ProgramData\61BF.tmp N/A
N/A N/A C:\ProgramData\61BF.tmp N/A
N/A N/A C:\ProgramData\61BF.tmp N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya\DefaultIcon\ = "C:\\ProgramData\\aPj8kPbya.ico" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.aPj8kPbya C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aPj8kPbya\ = "aPj8kPbya" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe"

C:\ProgramData\61BF.tmp

"C:\ProgramData\61BF.tmp"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x150

Network

N/A

Files

F:\$RECYCLE.BIN\S-1-5-21-2444714103-3190537498-3629098939-1000\DDDDDDDDDDD

MD5 6379cafa14363f572884fc5c83d89c3e
SHA1 0f35d6f715834ee63fa39315b34763c60a4ec2d6
SHA256 a10cc0de7bfc4b8f019400681d52ad4ab7f76c6c36b860d2e3477ea94c817a45
SHA512 fe132b65c37a1f64e97de437b58e7bf3bfa960bc2d6516c77599b732ba71da2eb4e6f38590b1004b12d6753c10a6603f45b3802675195c39dcc70ae0148a661c

C:\aPj8kPbya.README.txt

MD5 a4a44c115f77fb6a8b86ce357845c504
SHA1 5346db5cc94ffe243fce3ccbd74879580c9e49bf
SHA256 8ee6de1ebdc07b5c71483aac95b9deb667b0413c8c30a902e74df99a6bbe1eeb
SHA512 af02e93763b99d2b5e88580e0fec04ce02e7b88c76c40baf468ae60e57935fee4f38b28ea3660661ae80207ddf1a73e636d0567edc827c842d782627b39b18b2

C:\$Recycle.Bin\S-1-5-21-2444714103-3190537498-3629098939-1000\YYYYYYYYYYY

MD5 2ed9845628548ba4356ee8be47eba58d
SHA1 3c3f971eecc000bf69b327d13c4c44a06c911555
SHA256 aacbfa11b724f277f32186cec3464c1b1be2a8414daa3c14616728db0c521812
SHA512 be619ad5c2176c58b59c202889af4943bc214d7bb480fe1da7377ee8234b2e264a2e81fe3ad1c8aa3648e2e2a4c5375465c0a32ed0d064f10c8dddcd98e27cea

memory/1812-0-0x0000000000DD0000-0x0000000000E10000-memory.dmp

\ProgramData\61BF.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2016-849-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2016-850-0x0000000002130000-0x0000000002170000-memory.dmp

memory/2016-851-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2016-852-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2016-853-0x0000000002130000-0x0000000002170000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-15 11:55

Reported

2024-02-15 11:58

Platform

win10v2004-20231215-en

Max time kernel

142s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\3D81.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-983843758-932321429-1636175382-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-983843758-932321429-1636175382-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\aPj8kPbya.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\aPj8kPbya.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\3D81.tmp N/A
N/A N/A C:\ProgramData\3D81.tmp N/A
N/A N/A C:\ProgramData\3D81.tmp N/A
N/A N/A C:\ProgramData\3D81.tmp N/A
N/A N/A C:\ProgramData\3D81.tmp N/A
N/A N/A C:\ProgramData\3D81.tmp N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\aPj8kPbya\DefaultIcon\ = "C:\\ProgramData\\aPj8kPbya.ico" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.aPj8kPbya C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aPj8kPbya\ = "aPj8kPbya" C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-15_e18ad7e7c1f3b86250beb3deabe9ce03_darkside.exe"

C:\ProgramData\3D81.tmp

"C:\ProgramData\3D81.tmp"

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

memory/3236-0-0x0000000003070000-0x0000000003080000-memory.dmp

memory/3236-1-0x0000000003070000-0x0000000003080000-memory.dmp

memory/3236-2-0x0000000003070000-0x0000000003080000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-983843758-932321429-1636175382-1000\BBBBBBBBBBB

MD5 e39d9a4758dc61d72f45e16a6951ce64
SHA1 6c18918498eba333e50847a6ccc88ccdcb2130fc
SHA256 628465cbe9057a2d660dc47e73b4751cf51d63547d00ca49d678afa70355ba9d
SHA512 506c057f5765012bd63979346ba376cc0d5d0c5d064c28fe2fa944ad078388eef3309afa12ae284dd33c69b058896457f107c9b7a41128e6843719cbbcd46362

C:\aPj8kPbya.README.txt

MD5 a4a44c115f77fb6a8b86ce357845c504
SHA1 5346db5cc94ffe243fce3ccbd74879580c9e49bf
SHA256 8ee6de1ebdc07b5c71483aac95b9deb667b0413c8c30a902e74df99a6bbe1eeb
SHA512 af02e93763b99d2b5e88580e0fec04ce02e7b88c76c40baf468ae60e57935fee4f38b28ea3660661ae80207ddf1a73e636d0567edc827c842d782627b39b18b2

F:\$RECYCLE.BIN\S-1-5-21-983843758-932321429-1636175382-1000\DDDDDDDDDDD

MD5 3bf8fa8ead50377a192e95c63da67d7e
SHA1 95a74f5f522ace4d145ff8946e644a488709abcd
SHA256 116eac0a9d6e707fbf246a1ff7285fed6047862a772f70b03c6ec585c3c56f0b
SHA512 2f2aca3457be17eb04dc83bec7a0ab8244a8cdf2ce9fcf8064c176d50b50c980e969417d783f9c3df023785a69d05711f2847163b10c9dc41e3a78285b69ea04

memory/3236-2722-0x0000000003070000-0x0000000003080000-memory.dmp

memory/3236-2723-0x0000000003070000-0x0000000003080000-memory.dmp

memory/3236-2724-0x0000000003070000-0x0000000003080000-memory.dmp

C:\ProgramData\3D81.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4956-2730-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/4956-2731-0x0000000002670000-0x0000000002680000-memory.dmp

memory/4956-2732-0x0000000002670000-0x0000000002680000-memory.dmp

memory/4956-2733-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/4956-2734-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

memory/4956-2735-0x0000000002670000-0x0000000002680000-memory.dmp

memory/4956-2736-0x0000000002670000-0x0000000002680000-memory.dmp