Malware Analysis Report

2024-11-30 11:30

Sample ID 240301-gezt3adh4s
Target 2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside
SHA256 62cd43fbe33fad4b94d3899465546c7593b7bd2c8b92882285285f8dc896f459
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

62cd43fbe33fad4b94d3899465546c7593b7bd2c8b92882285285f8dc896f459

Threat Level: Known bad

The file 2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit

Renames multiple (568) files with added filename extension

Renames multiple (338) files with added filename extension

Checks computer location settings

Loads dropped DLL

Deletes itself

Reads user/profile data of web browsers

Executes dropped EXE

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Modifies Control Panel

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Modifies registry class

Suspicious behavior: RenamesItself

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-01 05:43

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-01 05:43

Reported

2024-03-01 05:46

Platform

win7-20240215-en

Max time kernel

117s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (338) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\28B6.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\28B6.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\o362vrt7x.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\o362vrt7x.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\28B6.tmp N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.o362vrt7x C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.o362vrt7x\ = "o362vrt7x" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\o362vrt7x\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\o362vrt7x C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\o362vrt7x\DefaultIcon\ = "C:\\ProgramData\\o362vrt7x.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe"

C:\ProgramData\28B6.tmp

"C:\ProgramData\28B6.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\28B6.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/1304-0-0x0000000002390000-0x00000000023D0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini

MD5 55b85028b72e1bfe4fa608a970b68088
SHA1 5f74d17508a6917be14e8b87a15335c46f151aa0
SHA256 f6f667c969a0ba7f51faad7753a2d26b4aaa4f4da4b0a757806d10c507a9cb34
SHA512 2d9eb953cfd27cc1739332830d922eb5bf324702bf7e42ce9f1aca0d695fc73a5f6e2b59021ec1b9fd99e76832c7f8e4d842491d027887d1bd5d1a85beb130f2

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\FFFFFFFFFFF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\BBBBBBBBBBB

MD5 3c645777ff6d5b450ce8f4333924292b
SHA1 d4bcf03bc47b2d34abac9e73fe41f47b077c151a
SHA256 c352306f1a1e67878145cd610645155a22f6c9997f6ddd853eba821fa4e4a1a3
SHA512 a19270d23b7490a8d616308719fa7a8556f851d1d5dce72fdb09f65e5bcd66698212e44edfe005cc4bcb1b013c2f73c2f8140c2b2089893eba022c6d51e38836

C:\o362vrt7x.README.txt

MD5 c0fecd98e2f6d9cc21e5bb7ee5189c2a
SHA1 46864f1a5e9b120c2850db121a666477d49de220
SHA256 b48ba87b58fb7c1fa70a4059fce7fb7d505c50f281872fe044f1f98545713fc4
SHA512 8cf95300f42501141d8b524e503f51ed1da9a51869d748d3d191555265e0642355271b2f1d25131dac9ff4578813578ac93574f684197e02db4a343a84cb71c7

\ProgramData\28B6.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2356-864-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2356-865-0x0000000002100000-0x0000000002140000-memory.dmp

memory/2356-870-0x0000000002100000-0x0000000002140000-memory.dmp

memory/2356-871-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2356-874-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 8cc2dbafbee40887d1e4daaf41e77c79
SHA1 fead75e510fb402aa421db6412dbad32b03a123a
SHA256 34e623d063f6263870dafd8363d194d42481c05c8eed0b6106fc0b618ab85d6a
SHA512 57a9f81859b5a6294d7de3e111fb76e3165de2f25acf27374c83deddf5ca8b75b2fefd810c4f54b7520d4a23036da6c615a086a24baacb2a0095f6d882c1a1ca

memory/2356-897-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/2356-898-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-01 05:43

Reported

2024-03-01 05:46

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (568) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\ProgramData\6533.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\6533.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\6533.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-566096764-1992588923-1249862864-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-566096764-1992588923-1249862864-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PP7iey7nedcb3rmy2pacc0oqmtb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPwnl0g3qx0lahxso0evk7lqumd.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPbq3jjwchbqeflnrwxg1y4kkqc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\o362vrt7x.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\o362vrt7x.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\6533.tmp N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.o362vrt7x\ = "o362vrt7x" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\o362vrt7x\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\o362vrt7x C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\o362vrt7x\DefaultIcon\ = "C:\\ProgramData\\o362vrt7x.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.o362vrt7x C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 532 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe C:\Windows\splwow64.exe
PID 532 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe C:\Windows\splwow64.exe
PID 2092 wrote to memory of 2784 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2092 wrote to memory of 2784 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 532 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe C:\ProgramData\6533.tmp
PID 532 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe C:\ProgramData\6533.tmp
PID 532 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe C:\ProgramData\6533.tmp
PID 532 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe C:\ProgramData\6533.tmp
PID 3744 wrote to memory of 4296 N/A C:\ProgramData\6533.tmp C:\Windows\SysWOW64\cmd.exe
PID 3744 wrote to memory of 4296 N/A C:\ProgramData\6533.tmp C:\Windows\SysWOW64\cmd.exe
PID 3744 wrote to memory of 4296 N/A C:\ProgramData\6533.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-01_fdce54c9c2be1935ab8a0c50063bda71_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{E135AB61-76B0-4633-B001-CE8CE67234EB}.xps" 133537454359140000

C:\ProgramData\6533.tmp

"C:\ProgramData\6533.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6533.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp

Files

memory/532-0-0x0000000003120000-0x0000000003130000-memory.dmp

memory/532-1-0x0000000003120000-0x0000000003130000-memory.dmp

memory/532-2-0x0000000003120000-0x0000000003130000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-566096764-1992588923-1249862864-1000\AAAAAAAAAAA

MD5 c679630ae378571ea3b37257f987d7fe
SHA1 e1a6e2716d129a4876c45efabf35358c305b6eab
SHA256 9a17754f244bb2d06a6d3439805e70f8a1d03d43fb14af1ea6dfbd9cd0c72f35
SHA512 2a9dca1c66dd017b7cffa4e801fa25ca0c5c4c5f14339965310e26b4109a4df8a43c205146344407047f9103f15efbfba304fa382f74bd334d442e0241c58efc

F:\$RECYCLE.BIN\S-1-5-21-566096764-1992588923-1249862864-1000\DDDDDDDDDDD

MD5 f355bd48bf413fd162e3c60ae5fa9c66
SHA1 d04b27e4827340f786366f8aebdea75dc09a7098
SHA256 97a731b3c40cf63cb0ea3a3e49dfb84aef4698b3dd9b81e9abeb2ce95fc8c750
SHA512 9f19ceddfbd116773641e5ef28e4cc0269511cbca87d046d729f400d25fab07593ce3654e1bbf4d1ee3c2f397452ae869760b1c3e821ecd2fc2b18cb68ecf0ae

C:\o362vrt7x.README.txt

MD5 f9c2bfa172e27af6cb6d1390d672649a
SHA1 bd8a6d447a6d5eccfd5fad9e452d9a2bfaaadca6
SHA256 abf1cc2805d61c53b0af89de80d1aaf8315821be2baae84752a76716d02daf91
SHA512 b41cd1f7b760504d49b96499194b1bd2cfdf975612fd4bbc4feee84ad41a01db9d3569dfa0ca1bd5bd64f9569c6209db5a54ed1c72a7fde84af664da52c1d4d4

memory/2784-2731-0x00007FF9980B0000-0x00007FF9980C0000-memory.dmp

C:\ProgramData\6533.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2784-2733-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2763-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 7e41e4f875b381f8533fa85dc85c7e7e
SHA1 43464bb0ccd3c17cdd17ef4a3d906f7ce1149903
SHA256 5c50c197d7e509714f0140b577ab03ef752dd2617d2b3b027ae2722b58557ac7
SHA512 60a355d60b874700e6e49ea88ff002e72b739a111e814197c155cbabdbacbad9a7487e2f30bebd2d45c64ca1bdb3adcec87eaa0d0276eea07fcc1e465cb57f64

memory/2784-2765-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2767-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2766-0x00007FF9980B0000-0x00007FF9980C0000-memory.dmp

memory/2784-2764-0x00007FF9980B0000-0x00007FF9980C0000-memory.dmp

memory/2784-2734-0x00007FF9980B0000-0x00007FF9980C0000-memory.dmp

memory/2784-2769-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2770-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2768-0x00007FF9980B0000-0x00007FF9980C0000-memory.dmp

memory/2784-2771-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/3744-2772-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/2784-2774-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2773-0x00007FF995FB0000-0x00007FF995FC0000-memory.dmp

memory/2784-2775-0x00007FF995FB0000-0x00007FF995FC0000-memory.dmp

memory/2784-2776-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2777-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2778-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2779-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2780-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2781-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2782-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/2784-2783-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 89388b9bde5155239471f50262e66f33
SHA1 da7c4679ee91a3e0ef7677deebe9d04df5ecaae2
SHA256 4b128c1566eb20de6773a3bbb6a2e5f71ead6eef38f50aa331c384348a87076c
SHA512 c45e93c847a546adeccca35d768defee67942b4757c8b5030ee24ffe2d402c0139a2a40aa4a2ca02ba5aa7a9e2d500334389339722f4d5836e37f6b0056d2281

memory/2784-2802-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

memory/3744-2803-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/2784-2804-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp