Malware Analysis Report

2024-11-15 07:22

Sample ID 240311-2kf95agd9v
Target 2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside
SHA256 1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8

Threat Level: Known bad

The file 2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit

Lockbit family

Renames multiple (286) files with added filename extension

Renames multiple (568) files with added filename extension

Deletes itself

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Modifies Control Panel

Suspicious behavior: RenamesItself

Checks processor information in registry

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-11 22:38

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-11 22:38

Reported

2024-03-11 22:40

Platform

win7-20240221-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (286) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\2D96.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\2D96.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cmAOMbVXo.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cmAOMbVXo.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\2D96.tmp N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmAOMbVXo C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmAOMbVXo\ = "cmAOMbVXo" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmAOMbVXo\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmAOMbVXo C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmAOMbVXo\DefaultIcon\ = "C:\\ProgramData\\cmAOMbVXo.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe"

C:\ProgramData\2D96.tmp

"C:\ProgramData\2D96.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2D96.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/2412-0-0x00000000020B0000-0x00000000020F0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini

MD5 4a7ec7d84f14fce9e675a6231d12225b
SHA1 b11f4017d93e3eec17de5888bb24779c9092feb6
SHA256 cb068d61ec2d01eb2054b9fe2932e1cd6294f462b06d69ec919c4c580222e029
SHA512 09e6e6129ceb6a146f73778a00ef968c32861b2a02cf2175451066d65ada6c72be09e81184962934f501099f1e8267d20f3099d313c84617b707579af7e06aca

F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\EEEEEEEEEEE

MD5 79f2d877de5b74ee6a2be1cfc112697b
SHA1 fbac50b93aeb8e4006aff9cdb39ff1da86c8f7ed
SHA256 c0d2043b50b3b02df57d6af936d882f5b48bc77c3bdb677ffbb2a011586fc037
SHA512 a91ed018b7340606729e08a7b8046aa4ff5ab19501a37dbb808f5084c0df61914a11d9b3f3865d284ff01163190cb36375fe3d100712d69d4b8ea9ea48dcbc05

C:\cmAOMbVXo.README.txt

MD5 9f0a6eb1992e38679a2aed0505211f2b
SHA1 5ae6bcac3c9df06abffc4a57f75b7ae22d82828c
SHA256 9d872db072dea5f2ab3d4104ba947cdcdc7b1b116c8c833e772fbcdec737d2eb
SHA512 c21443ee8c35ccfd0d1fee0120a376db144a5dd012d14e80f5f6aedee201e4187e766b2e25c28fa7e8655a64a3b232e9c6c721ddd6b6f95c3cdc1aea0fdcb279

\ProgramData\2D96.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1288-810-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1288-812-0x0000000002190000-0x00000000021D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 b23f094c54575492906ad7e440e3da38
SHA1 cfdffefec59dcf24535eb5d36a7028ec646072ce
SHA256 b207cca8c0bdaeb3a7c19e38b131f5058e2b6f59bda4cd5276bd0bfdce5587e5
SHA512 fd114d56b1c6cae21f7effd86ebcb8b2ef6428b694bb1c8f773767480d42d88a045c12b19130136754900037a906aa739114362adccd287cc46c8a259889fc55

memory/1288-819-0x0000000002190000-0x00000000021D0000-memory.dmp

memory/1288-820-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1288-822-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/1288-843-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/1288-844-0x000000007EF60000-0x000000007EF61000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-11 22:38

Reported

2024-03-11 22:40

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (568) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\ProgramData\7A61.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\7A61.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\7A61.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP2y3qq7vl2ztjyrygucglktvo.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPdzdiyeb0n0ao638gvww1wd5hc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPpa9wel18hwjpml3hu9dgxoxob.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cmAOMbVXo.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cmAOMbVXo.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\7A61.tmp N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmAOMbVXo\ = "cmAOMbVXo" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmAOMbVXo\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmAOMbVXo C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmAOMbVXo\DefaultIcon\ = "C:\\ProgramData\\cmAOMbVXo.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmAOMbVXo C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1684 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe C:\Windows\splwow64.exe
PID 1684 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe C:\Windows\splwow64.exe
PID 4364 wrote to memory of 2240 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4364 wrote to memory of 2240 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1684 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe C:\ProgramData\7A61.tmp
PID 1684 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe C:\ProgramData\7A61.tmp
PID 1684 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe C:\ProgramData\7A61.tmp
PID 1684 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe C:\ProgramData\7A61.tmp
PID 1924 wrote to memory of 1756 N/A C:\ProgramData\7A61.tmp C:\Windows\SysWOW64\cmd.exe
PID 1924 wrote to memory of 1756 N/A C:\ProgramData\7A61.tmp C:\Windows\SysWOW64\cmd.exe
PID 1924 wrote to memory of 1756 N/A C:\ProgramData\7A61.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-11_fc574bb43fdd40afb914909e27b0c02b_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{8C4AC857-189C-49AE-8BF6-C4170DCC6DE3}.xps" 133546703078120000

C:\ProgramData\7A61.tmp

"C:\ProgramData\7A61.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7A61.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 195.177.78.104.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 185.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
GB 104.91.71.134:80 tcp
GB 104.91.71.134:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp
GB 96.17.178.173:80 tcp

Files

memory/1684-0-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

memory/1684-1-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

memory/1684-2-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\FFFFFFFFFFF

MD5 fb7f3cfd04f676a3bca8d1d12f11b67c
SHA1 c3533d132f5fb5873d97e4d57c06562dce4bb792
SHA256 e7371de676d075b9035a33e12a3c7994aabef7762bf6ccab8135e71168519a10
SHA512 c4cef4e3bf8b3190375f5a62e7264b47aa7fee6561fa6660775bab9730e1c067048a3f562d9c1c21149167b40c5bbc00d5f84fdde93eb7657bf6af189a420557

F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\DDDDDDDDDDD

MD5 7005959c5d50a7310a24b57f2f050bf7
SHA1 c7a70994f70d6e7d7ab4024e68c794efbb6df21a
SHA256 0a56bbbfe69736148c8c16763cb55ab267bef809219cd69838bf994327b2824c
SHA512 5a00197014e615e968592d4eacc6b1340ca047ad98f730b2986be15b1f89e2b1ef16accb562bfe55b505723bda11c51d3e09d570e1a45491556eea2699444ce2

C:\cmAOMbVXo.README.txt

MD5 9225067cf1a1ba21d17ea26e0605822e
SHA1 4dadb8d5e70bb35e7329a12d5a1813239c409b5b
SHA256 8cdb459d87876149b635048802fb56bb7e1d564da4928707e19a22ef24aa3fe1
SHA512 101f75b6d9ed2c53e0f21f3808a5aa5e79d8561ad55239c2f660a2835bcb8ed0a25958ec520c0398bbcc800d92f2e4f774a8d1de182049c7f3ff48193711e3fa

C:\ProgramData\7A61.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2240-2739-0x00007FFF20730000-0x00007FFF20740000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 41bc386e1aa0c4484e8e11b7b151f726
SHA1 56fb744d6eaf062226a6d045ba7a3dc9b6d67247
SHA256 4a8423c1b2686ca993a2fea8d4c8c1554b7e25f6375993f4d234ef0cbccb70f0
SHA512 b65a2733189f363d6166f5de94aff1794959176bb599ea88ca2d4fa0af0344d1b57291b74bf6357c9fbb4653e2a347905e41595f00e1c53bc93169da1aa5f333

memory/2240-2741-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2740-0x00007FFF20730000-0x00007FFF20740000-memory.dmp

memory/2240-2770-0x00007FFF20730000-0x00007FFF20740000-memory.dmp

memory/2240-2771-0x00007FFF20730000-0x00007FFF20740000-memory.dmp

memory/2240-2772-0x00007FFF20730000-0x00007FFF20740000-memory.dmp

memory/2240-2773-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2774-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2775-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2776-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2777-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2778-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2779-0x00007FFF1E1B0000-0x00007FFF1E1C0000-memory.dmp

memory/2240-2780-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2781-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2782-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2784-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2783-0x00007FFF1E1B0000-0x00007FFF1E1C0000-memory.dmp

memory/2240-2785-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2786-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2787-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2788-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2789-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2790-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 43d5a358a49e9f7130748f162e83e778
SHA1 33a2f0ead0d1ba2ff3a29e0b1808dba795261783
SHA256 244af809ce3266590497aed47714fc6fa6705a88f0a9f64e721c6cdadc2d148f
SHA512 edd110ebb19314f337029f88379b05f25153bc5c7c76753210fac352dfedab533c10f7b98d3e1796eed3304a43bb4071d3df513ad32307a2264d77811e0a7fbd

memory/2240-2811-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp

memory/2240-2812-0x00007FFF606B0000-0x00007FFF608A5000-memory.dmp