Malware Analysis Report

2024-11-30 11:41

Sample ID 240221-s59mqsac4s
Target 2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside
SHA256 32cf89ca7cccc410ca4ad9bc58e22fe8920131687ef2a0d9f61d215c9d50d661
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

32cf89ca7cccc410ca4ad9bc58e22fe8920131687ef2a0d9f61d215c9d50d661

Threat Level: Known bad

The file 2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (584) files with added filename extension

Renames multiple (336) files with added filename extension

Deletes itself

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Drops desktop.ini file(s)

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Checks processor information in registry

Modifies Control Panel

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-21 15:43

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-21 15:43

Reported

2024-02-21 15:46

Platform

win7-20240221-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (336) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\4422.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\4422.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\CeP8Gfyd2.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\CeP8Gfyd2.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CeP8Gfyd2 C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CeP8Gfyd2\ = "CeP8Gfyd2" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CeP8Gfyd2\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CeP8Gfyd2 C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CeP8Gfyd2\DefaultIcon\ = "C:\\ProgramData\\CeP8Gfyd2.ico" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe"

C:\ProgramData\4422.tmp

"C:\ProgramData\4422.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4422.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/2208-0-0x0000000000AE0000-0x0000000000B20000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\BBBBBBBBBBB

MD5 423ce92ab1a00477d0e4a2e82d386015
SHA1 3b97dcc6e4cd4f3e8a4e9fce9c78a7c4a7f8d102
SHA256 fea1fd5c468fcb5b74997b7b59f5ab4fce60953799709a7f3e5426166209dcb9
SHA512 48012f1127f218377f06cdcf41c7184c686e4dde28488bea46c277f1f9595356aed273a03273adce42672fe81ae6270e04586ca5d97c9d91c54eed5b02a7064a

C:\CeP8Gfyd2.README.txt

MD5 bd2eea7aaf434146c2cb1e837cbaf8d7
SHA1 41d662b308c292304a837126683dd85736d55b8d
SHA256 f37caa4a44348eb0804bf5d1686ad4d6f0547535a55efdca1832958bf16117c3
SHA512 0067f2d95c8e51fd708c60de2206c1955f98c14ff61682d796b8621b49aa7e2606396c78f26b8a663c128e308089612ea9a2aeb0acbf80faa3d166f659dbc9dc

F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\DDDDDDDDDDD

MD5 78640b0a2e733b0fce1b6331b5200a45
SHA1 674c3c4e8d8c870d22fad7bbb35615560bebc2c1
SHA256 c9b7168363a75349ec36a17246307832dd8e1fe31879c0fbec872f840b616a3c
SHA512 9b3b9afa4244f4254f63e09a264584ad894c44edc2d8cc1d0a5c85a5af2b5d8dcec73e168154502f21bb3c652715e3f3a2af4ae43edf57cd2045d664ddc59996

C:\ProgramData\4422.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/596-862-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

MD5 6a2584b05e7f6efdf6de1a92ab4c0152
SHA1 8bc1d4c88daf01cffb80ca9daf97503def01bc26
SHA256 270df42e38c238e1b2f9ad27e7f7fb391805118704f3216309a117a344fa99be
SHA512 659e3077e3773cca16dde7fbc268fdd40fd79a2cf1b5df0292e9cb90f039582daabe2af39075a68cd9299aa631174a06ffaa7968a5c988aa38ef0f4cdb0af4f5

memory/596-872-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/596-871-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/596-863-0x0000000000340000-0x0000000000380000-memory.dmp

memory/596-895-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/596-894-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-21 15:43

Reported

2024-02-21 15:46

Platform

win10v2004-20240221-en

Max time kernel

147s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (584) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\ProgramData\704F.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\704F.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\704F.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-910440534-423636034-2318342392-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-910440534-423636034-2318342392-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PPs_vhy6vuhfndvdr60a650z4zc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPankqbwb0q7yulvi3u90ixt0j.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPx2w1eqtj56w34_a2atnb5y4ed.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\CeP8Gfyd2.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\CeP8Gfyd2.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CeP8Gfyd2\ = "CeP8Gfyd2" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CeP8Gfyd2\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CeP8Gfyd2 C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CeP8Gfyd2\DefaultIcon\ = "C:\\ProgramData\\CeP8Gfyd2.ico" C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CeP8Gfyd2 C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4972 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe C:\Windows\splwow64.exe
PID 4972 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe C:\Windows\splwow64.exe
PID 4748 wrote to memory of 1404 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4748 wrote to memory of 1404 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4972 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe C:\ProgramData\704F.tmp
PID 4972 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe C:\ProgramData\704F.tmp
PID 4972 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe C:\ProgramData\704F.tmp
PID 4972 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe C:\ProgramData\704F.tmp
PID 3236 wrote to memory of 816 N/A C:\ProgramData\704F.tmp C:\Windows\SysWOW64\cmd.exe
PID 3236 wrote to memory of 816 N/A C:\ProgramData\704F.tmp C:\Windows\SysWOW64\cmd.exe
PID 3236 wrote to memory of 816 N/A C:\ProgramData\704F.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-21_d448393d4c47c1f251bd4bd57aec126a_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D3A977C4-F8BE-4512-A9B7-B9189478441C}.xps" 133530038335090000

C:\ProgramData\704F.tmp

"C:\ProgramData\704F.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\704F.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 209.78.101.95.in-addr.arpa udp

Files

memory/4972-0-0x0000000003520000-0x0000000003530000-memory.dmp

memory/4972-1-0x0000000003520000-0x0000000003530000-memory.dmp

memory/4972-2-0x0000000003520000-0x0000000003530000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-910440534-423636034-2318342392-1000\JJJJJJJJJJJ

MD5 44c1d38eacf30d6b366e0660b12a9479
SHA1 a3ae6275229d43c47bc0d9c9451c31b0197f01e7
SHA256 78755ace17f9a626dfd594c0f6fdfdd037d7542b397b6362c64c95d5ca26982e
SHA512 0126d68ad7a63ba90c4e4a60e2f7f48552f945579f9896a30186d00b2e55c4dbfacefd7ef3e0afc3b1ff7c484511120c6582d950bc5a25e6d7f6a9cc7e5c1826

F:\$RECYCLE.BIN\S-1-5-21-910440534-423636034-2318342392-1000\DDDDDDDDDDD

MD5 428be0de0603be47d5d0185fac2b54f0
SHA1 d19433ca30d665a7c73b6b478d51129f5fb59d63
SHA256 0271c4ff6e0bc230a1e0401de3d322b8e99604c08690e0cb31beb2485a202e50
SHA512 239522fd36839c666be7e13487717e947826eb9685eab34459bd84d9057ead38f5fb598813aab1f7419f86e97b5c10136ae78f289a0940eb4e0196966e03461d

C:\CeP8Gfyd2.README.txt

MD5 19ddc417bcd3edda0a7de1035d36d0b4
SHA1 1ac89a381a69c67194c98c2160abc4b02a7c9875
SHA256 7e7a3ed1d790f0a3e84c94be0c2b998921b3003d04955803d8a1c5528a769931
SHA512 1ec660d4bad7c8159c7b3eb4b186fb233a64a828db123616cb61da7877982e8aad387ec82274c00d5a1f0cc82a86a422d583bf6d25918749303cade02d7219d6

memory/1404-2851-0x00007FFB504B0000-0x00007FFB504C0000-memory.dmp

memory/1404-2852-0x00007FFB504B0000-0x00007FFB504C0000-memory.dmp

memory/1404-2853-0x00007FFB504B0000-0x00007FFB504C0000-memory.dmp

memory/1404-2854-0x00007FFB504B0000-0x00007FFB504C0000-memory.dmp

memory/1404-2856-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

C:\ProgramData\704F.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1404-2861-0x00007FFB504B0000-0x00007FFB504C0000-memory.dmp

memory/1404-2887-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 8df727b189a17b3752f16ac4971b0281
SHA1 70c836229659b3f6660ca3610dde38dc982093eb
SHA256 c06c2b9b05e5bc684c28eb910dcb26d4e2fe320af3271a31b238f63e0d54eef0
SHA512 9b6b743c014e64a95dd687370c74ebbf40ddd8085213a7ad977a9dadec7ad0a4ac32a82555f37a8ed801ff52f4f8c8fce715b38708bc5a3110bbefa28fe07675

memory/1404-2891-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2892-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2893-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2895-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2894-0x00007FFB4E180000-0x00007FFB4E190000-memory.dmp

memory/1404-2896-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2897-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2899-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2900-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2898-0x00007FFB4E180000-0x00007FFB4E190000-memory.dmp

memory/1404-2901-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

memory/1404-2902-0x00007FFB90430000-0x00007FFB90625000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{E84E48D7-910A-4AC3-81EC-56B69F02D808}

MD5 07724ce1509ee0e6e853545d3eef6764
SHA1 ccbf1593d0968bc57b43f623a4a394ca8714a863
SHA256 84224e99df2481372529b8e133d6be251f7512b4193d8307774758a34ff065b1
SHA512 ee4c67785c818a4457a75e29cd48258d1962916f80df82cdf853dcc130c35e3f8448414f0c3704e77d9527c6662dbc41b14ee113fc3b649a66a85efbce59f9f8

memory/1404-2919-0x00007FFB90430000-0x00007FFB90625000-memory.dmp