Malware Analysis Report

2024-11-15 07:21

Sample ID 240311-jh321afd8w
Target 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside
SHA256 0b52d5d29e42804706f99a724ec94d0e2f0fd2a4dfcfbe4ff4e0403e00a71e49
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0b52d5d29e42804706f99a724ec94d0e2f0fd2a4dfcfbe4ff4e0403e00a71e49

Threat Level: Known bad

The file 2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit

Lockbit family

Renames multiple (627) files with added filename extension

Renames multiple (350) files with added filename extension

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Deletes itself

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Modifies Control Panel

Suspicious use of SetWindowsHookEx

Suspicious behavior: RenamesItself

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-11 07:41

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-11 07:41

Reported

2024-03-11 07:43

Platform

win7-20240221-en

Max time kernel

122s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (350) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\11A.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\11A.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\nbLGVxVJx.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\nbLGVxVJx.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\11A.tmp N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nbLGVxVJx C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nbLGVxVJx\ = "nbLGVxVJx" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx\DefaultIcon\ = "C:\\ProgramData\\nbLGVxVJx.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe"

C:\ProgramData\11A.tmp

"C:\ProgramData\11A.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\11A.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x150

Network

N/A

Files

memory/2756-0-0x0000000000420000-0x0000000000460000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-406356229-2805545415-1236085040-1000\AAAAAAAAAAA

MD5 a2014f4f8bb173261c8000ee8a4de558
SHA1 d171d55f4651726fda59f17e9c4f15a0330a1548
SHA256 fb5f6576330fb494817fe7ed4eba7b3896137462ef5d189b117b0f5a1ed03472
SHA512 69257e7bbf8009f5cbb4c87f657f0d40301407cd98a447da21161313e918f83535904074102c87f111b28371ba41e2247839400ecdb3db89fb912650c8c0ef48

C:\nbLGVxVJx.README.txt

MD5 8ec36b04934bbf8793887ff9024cecce
SHA1 47545f1bf4441ec36ac2990adf932d6e5664621c
SHA256 bdbb345693446842c655208ab5382a89e1a0b3b5ca5e609b4680d4924ee6545e
SHA512 3c2e19de0844cee030040e523458b6694e6442ad52fab2c1176cabf35361bea99eabcaf9c72cf2ce543f34e62463ab28d67b7e5079129fdb65c9d032191ad93c

F:\$RECYCLE.BIN\S-1-5-21-406356229-2805545415-1236085040-1000\CCCCCCCCCCC

MD5 d202da2b8c64ef7e73126c636b14cef3
SHA1 5645493db504fec43911031843e0ed9bde9ba63f
SHA256 36424f02dd5f363691269096a3727a7d01fc81ec6239a92a85259c970cf5b5db
SHA512 d8e0605f0250ce5a9a23dfdaca11776e2806eb994dfe880d59ca8fc77e589fcfb076299e6e61af682ef01d023e2c2e102b567f3c5c33c52d890320abac0c5eae

C:\ProgramData\11A.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1088-876-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1088-877-0x0000000001FB0000-0x0000000001FF0000-memory.dmp

memory/1088-886-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1088-889-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII

MD5 cb1aa085fb3c23e5ebf170df62f5a3fa
SHA1 b786f7e1fdd4e28c438486a969d334bd3a180203
SHA256 ef6a23b766c56ab9531172895517b9811d72c843d54fab77da74be9cd8f0bcaa
SHA512 4b0c3f3cfe3773711f3beb25bd1b18c3491089d04e6a4b1622ad9cae0ab45d6696c1be011b5b6dbbb32896297df45eab44377593319e4f75c862373b5c701c37

memory/1088-908-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/1088-909-0x000000007EF60000-0x000000007EF61000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-11 07:41

Reported

2024-03-11 07:43

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (627) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation C:\ProgramData\16C0.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\16C0.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\16C0.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPskzhikuqyh7l6eh0b8s3_9_hb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPtjdovgn6hdeznh1vx247zaxnb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP07odef9nhlqz43j_rcdgm36f.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\nbLGVxVJx.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\nbLGVxVJx.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\16C0.tmp N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nbLGVxVJx\DefaultIcon\ = "C:\\ProgramData\\nbLGVxVJx.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nbLGVxVJx C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nbLGVxVJx\ = "nbLGVxVJx" C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1864 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe C:\Windows\splwow64.exe
PID 1864 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe C:\Windows\splwow64.exe
PID 2164 wrote to memory of 3660 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2164 wrote to memory of 3660 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1864 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe C:\ProgramData\16C0.tmp
PID 1864 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe C:\ProgramData\16C0.tmp
PID 1864 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe C:\ProgramData\16C0.tmp
PID 1864 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe C:\ProgramData\16C0.tmp
PID 3044 wrote to memory of 4828 N/A C:\ProgramData\16C0.tmp C:\Windows\SysWOW64\cmd.exe
PID 3044 wrote to memory of 4828 N/A C:\ProgramData\16C0.tmp C:\Windows\SysWOW64\cmd.exe
PID 3044 wrote to memory of 4828 N/A C:\ProgramData\16C0.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-11_22a0002d0c856af8ce443c65fcfb3e66_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{DC68C758-98D3-435F-AAF7-63811FDCDC04}.xps" 133546164939880000

C:\ProgramData\16C0.tmp

"C:\ProgramData\16C0.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\16C0.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 91.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 104.246.116.51.in-addr.arpa udp

Files

memory/1864-1-0x0000000003180000-0x0000000003190000-memory.dmp

memory/1864-0-0x0000000003180000-0x0000000003190000-memory.dmp

memory/1864-2-0x0000000003180000-0x0000000003190000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\GGGGGGGGGGG

MD5 7283f27f3989edd11b94873a2fa74d87
SHA1 92f73e5368d207590cffa387b3c28984f41f0be8
SHA256 c9893943aa654e51c36d779fbca19609306e20e94e697089a27c48737977ab2a
SHA512 036a885e26d2927915f2942e4832a74241ff6939a9d5058b7681683231c3b03645ce9fc7ef1b1c7f15e700cc5afe1a1bed8d728e84d07d4a91b21cd38425217f

F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\DDDDDDDDDDD

MD5 7f5709c7cd72800c3b5df38574521de2
SHA1 11440296909e66acbd7b246cdcf6b599ce211929
SHA256 57e88554425a023932981003364445c2052a05cea54b4cc54dd57b08d4005d1d
SHA512 fcaf8b9232b7d1aefd88a5eac3fedb7eab8a7a3979e48f4f8e001dc6b834651f59097f7e1f6608b2bec7cacc53696e6a3e97c708cdd078058064b5608dc233ee

C:\nbLGVxVJx.README.txt

MD5 925628a04137959fcb4f6d98274fc2da
SHA1 44700f588ed58fe9a52165b539375058c026117e
SHA256 59741572f7916999fc43d63e08f51501881c58723ab0496e737a4c72c7e698f3
SHA512 db9e94974c21feb45aad92e072dc5e12dbe4cd7909f6383ad5ae04d2d124787b54559159600f0b709509e8434882beebdcd23668b40ac0f843c82313a16d3f9e

memory/1864-2761-0x0000000003180000-0x0000000003190000-memory.dmp

memory/1864-2762-0x0000000003180000-0x0000000003190000-memory.dmp

memory/1864-2763-0x0000000003180000-0x0000000003190000-memory.dmp

memory/3660-2776-0x00007FFA41930000-0x00007FFA41940000-memory.dmp

memory/3660-2779-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

C:\ProgramData\16C0.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/3660-2781-0x00007FFA41930000-0x00007FFA41940000-memory.dmp

memory/3660-2783-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2786-0x00007FFA41930000-0x00007FFA41940000-memory.dmp

memory/3660-2794-0x00007FFA41930000-0x00007FFA41940000-memory.dmp

memory/3660-2814-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

MD5 2d6860673e99962b483ca6023b850493
SHA1 2e0465c0abb9939f33c17382480a80a70280536b
SHA256 6c406621835f8daa7e779fb91c5a3d6ca0ec0a5ed6fec4d2d05b7e4e1a17ade9
SHA512 dfca4b6c83b231f20a6b91eec9dedd7ef4d247be8a719f8a36eab301d5765547a020579dc9c36c90df88a0d2149a2291c37d3f82b407d74b536851b23ed38de4

memory/3660-2782-0x00007FFA41930000-0x00007FFA41940000-memory.dmp

memory/3660-2815-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2816-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2817-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2818-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2820-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2821-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2819-0x00007FFA3F560000-0x00007FFA3F570000-memory.dmp

memory/3660-2822-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2824-0x00007FFA3F560000-0x00007FFA3F570000-memory.dmp

memory/3660-2825-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2826-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2823-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2827-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2828-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2829-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 0077cfc77d193c3bd67357cd3d35432f
SHA1 504b46202501d4f12499e6ef187a9aefba47a3ca
SHA256 427b1475b054424616ad40761fe9688098ba86c9b72863d7738986af468ef83d
SHA512 725a7699eacdda8a0efc232ef7eb0fc3cd639e0596f3644e198c0bf8e8d6c0b114a16c7a520097d7bf74c1ab34f2f891ea07811c95035bb951cf94ee06ea5804

memory/3660-2851-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2852-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp

memory/3660-2853-0x00007FFA818B0000-0x00007FFA81AA5000-memory.dmp