Malware Analysis Report

2024-11-30 11:31

Sample ID 240224-e5lzsahc46
Target 2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside
SHA256 8b6946cca11e9507df8234e0c68567f19a893c3f08b1d384b88808846d67d7eb
Tags
ransomware spyware stealer lockbit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8b6946cca11e9507df8234e0c68567f19a893c3f08b1d384b88808846d67d7eb

Threat Level: Known bad

The file 2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside was found to be: Known bad.

Malicious Activity Summary

ransomware spyware stealer lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (333) files with added filename extension

Renames multiple (595) files with added filename extension

Checks computer location settings

Reads user/profile data of web browsers

Deletes itself

Executes dropped EXE

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Modifies registry class

Checks processor information in registry

Modifies Control Panel

Suspicious behavior: RenamesItself

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-24 04:31

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-24 04:31

Reported

2024-02-24 04:34

Platform

win10v2004-20240221-en

Max time kernel

92s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe"

Signatures

Renames multiple (595) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\ProgramData\7FDF.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\7FDF.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\7FDF.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-910440534-423636034-2318342392-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-910440534-423636034-2318342392-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PP4ha99_wgmuhq16p_dik3irerd.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP66zmddtxhmejuped4p3k0zz0d.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP1e3tvmfq409jvgm8wzem__55d.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\gXokUr0LJ.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\gXokUr0LJ.bmp" C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gXokUr0LJ C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gXokUr0LJ\ = "gXokUr0LJ" C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gXokUr0LJ\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gXokUr0LJ C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gXokUr0LJ\DefaultIcon\ = "C:\\ProgramData\\gXokUr0LJ.ico" C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1232 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe C:\Windows\splwow64.exe
PID 1232 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe C:\Windows\splwow64.exe
PID 2208 wrote to memory of 1492 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2208 wrote to memory of 1492 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1232 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe C:\ProgramData\7FDF.tmp
PID 1232 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe C:\ProgramData\7FDF.tmp
PID 1232 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe C:\ProgramData\7FDF.tmp
PID 1232 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe C:\ProgramData\7FDF.tmp
PID 3304 wrote to memory of 2284 N/A C:\ProgramData\7FDF.tmp C:\Windows\SysWOW64\cmd.exe
PID 3304 wrote to memory of 2284 N/A C:\ProgramData\7FDF.tmp C:\Windows\SysWOW64\cmd.exe
PID 3304 wrote to memory of 2284 N/A C:\ProgramData\7FDF.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1B12399F-2D26-4124-9EE1-A7CDD22BA7B8}.xps" 133532227041050000

C:\ProgramData\7FDF.tmp

"C:\ProgramData\7FDF.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7FDF.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/1232-0-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

memory/1232-1-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

memory/1232-2-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-910440534-423636034-2318342392-1000\HHHHHHHHHHH

MD5 b739dac08e227679ae9d5a20c6572491
SHA1 cf1f3944af23c4857f7be48ee480235ea69f2827
SHA256 d55a8dc404ac930ead65731d115bc1f5a5fa81d496bc036fd65f4e36ca0cf826
SHA512 d8cf803917d57659f54d008b78e86b48e9518636bcd54426017f06244e67c18909ac3e6980178ecba2c2b3c1dd463139cd6b69ad2faeffdff6353f1fa89fa973

F:\$RECYCLE.BIN\S-1-5-21-910440534-423636034-2318342392-1000\DDDDDDDDDDD

MD5 e483c814cc31eb93123e872dd346ebcd
SHA1 92d8b841e880e422fe280e21b64675eaf7ef354d
SHA256 088c49b66d4eb0815664d19bdbab75314b8c6fef30b36d91548f294f536ab805
SHA512 7dba87774b7b6c26b8027734c9cde2bd068a4a8a1c99115dc5a1d257d87a2ebc5540744771b32d52dc803ef2d6fec6174be6d61aa60536fa4d5e6d0bddf92690

C:\gXokUr0LJ.README.txt

MD5 64afd1a28fa98ca5957a3bd1ba61a990
SHA1 e76dd799a8cc56b0de8c1ad6f19232541da97945
SHA256 651f0450f5fbb2a9e801a3f848dec5be95b989d5c3565ce02d9d629fac509624
SHA512 755e5e1e0117a8423e26b9458caedf00050f46efba4652beef26a66b3174b6c5f60c7aafff0e10f51477564a521fd2918aaf527166ad5fb301ce577b45aa422b

C:\ProgramData\7FDF.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1492-2870-0x00007FFC3C570000-0x00007FFC3C580000-memory.dmp

memory/1492-2872-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 0a45edf0c8a33d887512859fff8c269f
SHA1 263402397c1447489be98694e93f1a36fc6f16a7
SHA256 9d732a8f5d42c55866dcff95f67e81fd2f69bebc9fadb38d8776046c6dc4f0d0
SHA512 fbfc0c438863d48be42fe761ff8a09c04ef317f8b70dca5426684a9f2644e4a669bba59e5ef1b07fdf544c5a0b85ef0a7a38015f35b46a3e1a5c0a71a3f204e2

memory/1492-2873-0x00007FFC3C570000-0x00007FFC3C580000-memory.dmp

memory/1492-2903-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2904-0x00007FFC3C570000-0x00007FFC3C580000-memory.dmp

memory/1492-2902-0x00007FFC3C570000-0x00007FFC3C580000-memory.dmp

memory/1492-2871-0x00007FFC3C570000-0x00007FFC3C580000-memory.dmp

memory/1492-2905-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2906-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2907-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2908-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2909-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2911-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2910-0x00007FFC3A1B0000-0x00007FFC3A1C0000-memory.dmp

memory/1492-2912-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2913-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2914-0x00007FFC3A1B0000-0x00007FFC3A1C0000-memory.dmp

memory/1492-2915-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2916-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2917-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2918-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2919-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2921-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2920-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{754BFF6A-C1FB-4771-9098-4C58DFF3F1E2}

MD5 67d265ec6145aa6130566f4dfeca83dd
SHA1 8456dc42c8a998498a7a42a6874e3d80b28dcded
SHA256 16a5eaa679a6c24af6f284306530f65a088cd28426b50a9abcc3889cf3c0305e
SHA512 8707b0f4852f0bc73a38e1e958268c981ca43632809f073482a511c59ca6ac2253679021395983469b23e6d3e908a133c245039ef9c4a459251d73b2fcc58d99

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 4fe25ba64a980bb55442e652237eaf7f
SHA1 b8d250272fb3cd0af82d8215df00171afbdae259
SHA256 a655254e89aad1135c03ee5a37ccf5dade9a0f1cd034975a511ce77415f9212f
SHA512 b83d079081b35ce73c0a8a7eacc1d7263126e6b4c946431bbce19a129bf3cc2715d9ad76e485b1fe6ae4393c74dff5792c22c1ca5e891f33d7518b88fbdd5131

memory/1492-2940-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

memory/1492-2941-0x00007FFC7C4F0000-0x00007FFC7C6E5000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-24 04:31

Reported

2024-02-24 04:34

Platform

win7-20240221-en

Max time kernel

149s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe"

Signatures

Renames multiple (333) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gXokUr0LJ C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\gXokUr0LJ\DefaultIcon\ = "C:\\ProgramData\\gXokUr0LJ.ico" C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gXokUr0LJ C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gXokUr0LJ\ = "gXokUr0LJ" C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\gXokUr0LJ\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-24_2c93d9140330805fa14abc112bcc7a17_darkside.exe"

Network

N/A

Files

memory/1696-0-0x0000000000170000-0x00000000001B0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini

MD5 a8108fb31af80650aedf1773e64246aa
SHA1 df0994ac1fb34d687f4e7e5a32a050039c5bc3a0
SHA256 a720e6e0fe11019e85df2f66b04c229f51d67b7eccc72103bba232207a915c15
SHA512 d89af037afa3d6f64c4e072591e03b36c6be4f91af053c3ba229325f9b01a1fbd68b1629cf43a68b08c5a74f41e96f81962f0e2a4ca816fc7305e83ebecbd480

F:\$RECYCLE.BIN\S-1-5-21-2461186416-2307104501-1787948496-1000\DDDDDDDDDDD

MD5 417bf3af82c9076c5a6e489c19e62b1d
SHA1 ded467a100ccf7367eb855ba14304ba55c5b7f4d
SHA256 5a9b40daf3e9ab245ae3a8b91de7b83c09d2a33352a2d1cef74ccf293d2f4abb
SHA512 8c3f5a61135b29b38f649b3d0cfd79c5b0deed6acf1a31c09c7be7a9309502ac653ac79b915ba10cf9ca4c3a8b85f5db80733935c7b0d91a7bdf04450a3b47dd

C:\gXokUr0LJ.README.txt

MD5 1823b09b0b8a59c01cdd05aa6f702e9c
SHA1 a4cceb8aa5177dd1c734878893a48d873d6c2db1
SHA256 48d06cfe929454ed165a88f8bd16b2172571f2e2e52bfcc57196034f35be26bf
SHA512 05639328c68d2535c8cb1377934ccc455db62843dc2dd2ff41ba2d6abee99ee952f2ba8b4a7d437549e6cab13e1c7a55b859198a953615a2dbfbe262fbd86fdd