Malware Analysis Report

2024-11-15 07:21

Sample ID 240312-ml5a1seg7v
Target 2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta
SHA256 a0e6a9fec2e7ed51bf36286e416deaec40e6bae8174e8c3fb3c1996fa7ef81ed
Tags
neshta lockbit persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a0e6a9fec2e7ed51bf36286e416deaec40e6bae8174e8c3fb3c1996fa7ef81ed

Threat Level: Known bad

The file 2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta was found to be: Known bad.

Malicious Activity Summary

neshta lockbit persistence ransomware spyware stealer

Neshta family

Detect Neshta payload

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit

Neshta

Renames multiple (140) files with added filename extension

Renames multiple (186) files with added filename extension

Reads user/profile data of web browsers

Checks computer location settings

Modifies system executable filetype association

Loads dropped DLL

Executes dropped EXE

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Uses Volume Shadow Copy service COM API

Modifies Control Panel

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-12 10:34

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-12 10:34

Reported

2024-03-12 10:36

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lockbit

ransomware lockbit

Neshta

persistence spyware neshta

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Renames multiple (186) files with added filename extension

ransomware

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\O957g99QW.bmp" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\O957g99QW.bmp" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Windows\svchost.com N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Windows\svchost.com N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW\ = "O957g99QW" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon\ = "C:\\ProgramData\\O957g99QW.ico" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2664 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe
PID 2664 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe
PID 2664 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe
PID 2664 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe
PID 2424 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\ProgramData\5C34.tmp
PID 2424 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\ProgramData\5C34.tmp
PID 2424 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\ProgramData\5C34.tmp
PID 2424 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\ProgramData\5C34.tmp
PID 2424 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe C:\ProgramData\5C34.tmp
PID 1580 wrote to memory of 992 N/A C:\ProgramData\5C34.tmp C:\Windows\svchost.com
PID 1580 wrote to memory of 992 N/A C:\ProgramData\5C34.tmp C:\Windows\svchost.com
PID 1580 wrote to memory of 992 N/A C:\ProgramData\5C34.tmp C:\Windows\svchost.com
PID 1580 wrote to memory of 992 N/A C:\ProgramData\5C34.tmp C:\Windows\svchost.com
PID 992 wrote to memory of 2708 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 2708 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 2708 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 2708 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\cmd.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\ProgramData\5C34.tmp

"C:\ProgramData\5C34.tmp"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x148

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\5C34.tmp >> NUL

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /C DEL /F /Q C:\PROGRA~3\5C34.tmp >> NUL

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe

MD5 75e3d908fdddee413481dba88258783b
SHA1 4cd6c1a88f3575d298aa168356651d5237bb72ab
SHA256 36aae3ba1a6fd78e040bba4522f6c15d5a3627ae78b27ff6879ee64d038445a4
SHA512 d7c1e0bd3eb3888579ef696ea48ae4d83d70f08b3bafb23288a81ed40e1501513e2739af119c4a0f9d788f7aa4a6500df80260151a8eeeb7f6fe19fc5cf34256

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

memory/2424-14-0x0000000000580000-0x00000000005C0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini

MD5 2464bd2e9d9b793f781fcc95af03062d
SHA1 cdf5eef2b46f1ec7e324999f11c88baed2bf53fd
SHA256 004ffe9a00a21513bf1d5dc61c728ab7bfd10defb231a16787a586ea8b4d16bb
SHA512 66f4c163aa3b3424c538e982823d12795d21dbd2ebbf74e57d0ea4bfefa2da631c26262df71ddadaa6ec6f48c31268665b7c1acb579a7578257dd8003bb40967

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\DDDDDDDDDDD

MD5 8016f935675267d311d5a8c859bfc51b
SHA1 0fa1bf0e634cffa307de5d2c1cc2efd3cbd48c45
SHA256 b36035117b6797e7e0524a96b35aaba4666054fb98b2afa6c890c5bb59c989b4
SHA512 d33a40eaa31f8f936b0cf534e6e46abe3b5bd08450e6d519162448ed086af3c6a2782183178df516d19c9183e56493c44567a1cf68cabae01a8afaa57c1678f0

C:\Users\O957g99QW.README.txt

MD5 ccd0020a56b259b7603254459a6c57a2
SHA1 1561f25c7b343f7d68cf52282623185d54f32fb7
SHA256 9db19336f347d3cc82b7d5686b29499b391c28007a774309090028e8f154cfd1
SHA512 beb385cfc4e61c4ac170a4d49394e2d9040159af0f0329d3dfd9afa889ef9a7d8a0f752a3cfcb41ae04eae7f47b96b10d8128054a5ee51533361e4238ab55d55

memory/2664-395-0x0000000000400000-0x000000000041B000-memory.dmp

\ProgramData\5C34.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1580-404-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe

MD5 a175ca484940389283e07fb84d8ffc42
SHA1 9cef46aa62f7aed8432b9ff5de84db4cf0136d0a
SHA256 2f2025850e0b4815addbb66a07c2ef3098b1f9be82ab6b8cc302d35bf505d5ab
SHA512 aae517fcc14790a939dfd3c33e4190c786032f10cf8d1e56f38ca28583b08767d1293fecb4a73f5255ea5fcb9ca6822ff471b76b0cdb2ee0474be372fa018127

memory/1580-408-0x0000000002110000-0x0000000002150000-memory.dmp

memory/1580-435-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1580-436-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2664-437-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2664-438-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2664-439-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2664-440-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1580-441-0x0000000002110000-0x0000000002150000-memory.dmp

memory/1580-442-0x0000000002110000-0x0000000002150000-memory.dmp

memory/2664-443-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2664-444-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2664-447-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\svchost.com

MD5 36fd5e09c417c767a952b4609d73a54b
SHA1 299399c5a2403080a5bf67fb46faec210025b36d
SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA512 1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{61087~1\VCREDI~1.EXE

MD5 24c5dfd895860fbf605570b662fb3690
SHA1 9314c19dc8225b8b4b8a16a170b72d7633de242d
SHA256 570f2cf4999dbed52cce548c8c55acf6b6af8546b4ac901a27632cc9c59f7e2c
SHA512 a3d318d5001fce7b80e23aef75fb1392227b83bb2b3ac84909de3df5100adf96ac1a11cb931dd1f0389492bab3ddee7777f5991d887dd9f23b60597d88f25931

C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

MD5 139007b8c6635d18742fba227563b6cd
SHA1 fe0fa1101937f91d61ab8d3b11b0ed5b5dd26518
SHA256 467aff60be5fb37c0dc8b59a6590d857a4c052bf9099caa57c5c2bbb4cbab349
SHA512 4b15e13105f2e99c0701dd90edcead5ded363b84370216cc96ca868f4bba6efa8090e038bb0372644e5c166fc6e99414f839da6bacef0c1f868b1a147ba3f2d4

C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

MD5 18ff8ef3d803c9062ba9d921a92ef791
SHA1 59ed19106bd17031d40f553cc754a3b61b363e1f
SHA256 6e51c5f3ac76d1083b3557e58053aa6fb3ed6f280566e9ee30676f48d05f9282
SHA512 beea19c5598ab8bc048ff1af6e09382679a0f120dc53905c54cf03d3ec46aec6756d33680795da2dd0abe1220319231cafcd0ba483cb627ff5eea8a08ef026e3

C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

MD5 648f3ea73ef1d99facde9573a0db8e4a
SHA1 a4a4b417a8b066a627e03ac061c0f5042e3070c7
SHA256 1b24d63a2e5186d796d4a3fec8fbf1b2c6fb7656873e199da964b2ea20f74ef9
SHA512 0bd5ba98ffcc743ea35beacfef719c97d48da54b114faa59bb8aa52ef7c252d57583aff6b44007041faef46f01a938176a924097d0a6a3c6e4e9c4201940710b

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 61c0f507e8e4f9b7c31473dbd9fdaeb5
SHA1 4763c0d359415a1fab9a95f1b206a93657aa65b1
SHA256 25964ee4b84fee6637cc70f6a1161c0415dee5a8ad7e9140ff919ad9d012587d
SHA512 5ab8bde91d4a9485c388123bff42866295ee29df3f11f3e8261031bcce057f1344b0c5d210777d4e26544aaee2013ce14e0b4863d0228a25e6e299369038d642

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 3cdc91ddf1cec04568251afe2c98f4c9
SHA1 b83c7c498ca4d4894764466c372fe5a59f190b00
SHA256 c69143a0f7546f6aee87caa6445011a6f991af0aff75e2ab6f3bdbf839b1fdd6
SHA512 9051e4cf51412e2439a93e094e70e352f23df154381706b501b8e5cb12f762c31b59d6369104a2d69ec91e4131730e749fa7dd13bd0a8cfa332d0100a0de2d71

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 8e352014bb8179579b51f15ac6cc43b2
SHA1 49c23d38c11014c606529a21b069dcc4ac441f25
SHA256 351fff4f63c706073273dc97996c3011fcf7bc43d8c81cc21b5b6608420daf3c
SHA512 0f01e94bac0157d1d19bf89ca3ca826e5501e59aab3e7918b8265b2a35db041c02791d888ba855fc9088fb35dd393e1a840f77ffc062a1551672dd6acb2ba640

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 3c9202ec76fb78112e2bb6395d3c244f
SHA1 9c11456eab4db0f6586ed22cec70cd3592c0948c
SHA256 f4ec778b5d22c066afe88ae0e4bea2424b930f8af4d1c0231a67fb7344f3a93a
SHA512 c0defd9a2ebd01cd92cc61c516bac30a3365cf0c54a7dac4d89c7196c4ec32bbf4609b3ebe8ab3ee5b84418c3b0e439a4b43b05f11e6892de51d026248bdca46

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 8e36dc4124de172a5e5ed72e5d985b30
SHA1 524eeebf6c143b82d971ab22076ef53d88526a92
SHA256 4d86b8cf08727de5ec964756f80e18853b7f077bb35f5d827fa3bac02d320bf1
SHA512 a033e978dae6c6485523cc446030bf58bb5fbef5594346a6bde2f72d9ea52e124c0036d44785a13e2bf770d85778fdcda4412206c8e6638a2f71b9a60c10558c

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 0c8920b199d68c31edc6732810d5abe8
SHA1 18a1954ee9f19d1c6310a81863faa91a1756ef95
SHA256 42b9140abf67305299ec1e15823355e76adeb30530112f24358520f9aab63621
SHA512 decfc253e7ed90030e4b008df8ab19722b4ef227e257ff7dd1c68ca6905973416d1caad88c60fc0ba84a90d5e0863a74e11688a6b310ce12e6d22fb58314e754

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 104c632250145892e4c658bf50112e10
SHA1 731c5b273b4a5e438eab511545b38b49ea6fe40a
SHA256 2e871d8f3160584c99fdbc9b9c1c6253312202e39037578bf42a60dde4c71197
SHA512 038dafcd99acbfea2c3ca3ea9ffc56af014db2551ab98e28a1067d26661df7044dcf4cbc701885acea44cacae1a27ac21ce06565b75f55ee94857888582aa2af

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 c9fa56d0978f894ea1aaddb2f40fec53
SHA1 a01fe27c9ea735b417ae4a8626f1fa0515f0abf0
SHA256 d940ced7b80108a799f64b904450e6f9e3a9fc2246cd39a1c814b3b66b8214d9
SHA512 f5d61e7dea3cc9173d3413e3d16e227c9dd295880f5dccd1063462525381bbc24e77b4f7c73345544ac3dd3aa9cd9c56ded8250790fa810706741181fa64aa42

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 64b8654c956120b45b2b7e8a98dd577d
SHA1 366f4f7a0519e329de4cfb7f570eca33443e5c8e
SHA256 95902dba1dfb1802c54406cd72a0b7d25d38e0e63aa5b1bc96ba5d24685a0aa2
SHA512 ce02de227a53633aec3b11551a6f57e136d5f8ad5de918c8ab7486cbcc02e735760ff0971046576b49a8dc26d31751bf14b02f2c46032b048ba4edbdc36bb045

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 6175c1c0f6c5a82b291871d734ef46ab
SHA1 f77b3cf33181643ee02ae8786abad3cf179c5d0f
SHA256 f70e93ed700013545118ad7a323cad25d03d912e2b4c869975dcc6c2e10d6bd8
SHA512 ecd0ee31a06e9f267d39e585911ae5a23c9634329a0503f28e2600db76fd64ddd6f6627c7a70eaae98e85b11dd04d4cb12bc3aa17db678b6e08c6571f31eff20

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 ec3f8efd105b0ce61f37ecac41f671ad
SHA1 41722a94ecc20b9c1aacc242587c2a5a416654c5
SHA256 4ce2f06c82e26989030312be36f5830fb7ac8546bedb4999bb0f986176b15583
SHA512 f9291a03f09f5793a802d7567fabed1441ba2cfda980058c939fe595bfa11daf2ceb04d2c0d68cf887a8c1323111403aa8b0148fdf14e6fc0c58199d4c390639

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 898375c6974e5e33eef0629cbfc09686
SHA1 99d960b6de8b5b3724b965f5c899daecb6a9ac32
SHA256 b63ae14be50731147d559115d24f05bc28b79021331e45897780acdd1e58a75b
SHA512 a6f61af6e3a33957eec4f6a8ad23cef48d8f8512dc737ca8891ceef72e1ae1f670d70a03d405289e1469662b76ad01ef5853a605551a9c98be7b59373c1f2706

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 187ce0baef0cb808a268fa699bb51a91
SHA1 00b88d4a11a2c41636335b5b770e7f4d1b214ee7
SHA256 5389a7be581f7685e476b5fb3a9755ec541ce8ccd620d64d36f633c0e9c4c575
SHA512 b6c4505611f18c9586a0a10604e9b3f530770c641dec10eb962be18cbcf0b7da48073a0f9abe1d2e525f8a7ace6875d925928c85c94578cd27ddd6ed246c4813

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 130276acc5f632aa2f829225e06053b3
SHA1 31515dd44e222c34b726d798ae26c71ed8e5f570
SHA256 387891bbdd8b6c20d86b77e13039165b0bf0d324dea20d915476d3881d739ba3
SHA512 8394a0c8b7c8933bd3e214a46263e36f20c607379f15b6b1da852bee9065c96d2b059e945b418cea0bb3d7ef9ab8bd85cefed5a6abac9d7dcb77268b8d46ef85

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 2866b8104a439f3c6226af2cfbc0d1a7
SHA1 1fe9b8706ef6e83f45cb7c1ee4c2c857245627af
SHA256 34faa306357c9da00ac2bc4679e0890313b5ae96c648a5f7fd3806da62a32587
SHA512 b9b282126ca9811419024bbc9a82959cc511715f563080e6bf0864cb31743180d9518835a90f5f66d28cdf01308ca5ba77854aeb085a48066f65071768f64e37

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 a62fc2654bdbfc4c75e8692ee3527f55
SHA1 4088e11873dc706448173c401df740b0c14eab5c
SHA256 7de70b1bafa5415725ac4f3b74bee6ada458a22e745306056bbb230d483e2ffb
SHA512 82df198c16f9ee05ed927209302a24370353b9f0949215e84d27a3fca2b4060d85ed3595ca681e053deac9aee8b62f7feb05d5e8d5f85db584b1b9624b48b246

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 fabd61bf97e435984b0cb67c937f0049
SHA1 61ce59106be51d51fb16b7cea5f6b3ac395259c5
SHA256 84466f593f3e6062e000a60041eb79a5a2af0f69cc14aff00d88913f8907dc60
SHA512 4ebade3602a336c7488b5c030f56a76d2c54c3b63936162a172f34cc0485fb5a583d33b01fde5957f8ad2d278b7b6c4fdd8b0b4f88ca7ca1b7b1a5641de9fd8b

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 67a7d1da5a79e99501f9e862942fdb3f
SHA1 80aa2c6e453dc6ea742a8cbd72fc315d7cf1db86
SHA256 927c3f9c8ae5f6d533c586aa25545c14f80899389c6250dd9747fb1a4b95ae71
SHA512 2a687121e7de7f14f4c4fb387e9724d04ac9474278eda39856469ffdabfee7a7bd49a8e13d022e4057853af39f94c647367850c77335dc08d79d6115250b0c70

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 ccaf6b444aab7ef75168300dba7d75db
SHA1 687b946b433dd3f24792369ae5cda34c1d7ed266
SHA256 51e0b31d820e3b4d3efa64d960b9dc497ce3505e4217bfdf25a78ee1f8612747
SHA512 9f41c94cd70e44a1afc405ef36746a0e86b70eb82b346138e3677f44934be4d3f4c3b90068b5d558cf5fba715329a2a141ceace0b958d9751a66a6e40a8a2a9c

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 91c57f898958f1b9ee322bbbaeaaa8b7
SHA1 625771313c46a19c3e2abb0298f1a46c44cdda13
SHA256 9daf27feee51caaf1f80ecbef6b95edd0032b90dedd7877f6ae6f34f8a166f76
SHA512 0e8161cdc769b553fcea9e5983c98b6a0bef826ef59336ae4f35f60fe748fa5fc26f4d4c31619dc1799ed983f1f72376ac88f250181400c10487d9c28185dc86

\Users\Admin\AppData\Local\Temp\ose00000.exe

MD5 5fa12960c18b210df20f17a8e490a36d
SHA1 6aaae027aeace6b4f220b230ae953a8e371a8732
SHA256 8ca9966345c004c565ef23c1161db338e82ba66fbfa3f8ee3dca75990a39509f
SHA512 4ce4cedc48affc5e421cf5adec2bae7c62f59a614d614de1d661a1c85826b60a3d2bada622aace36b4c867237200d4d79ed8eb12fcf8d64af921c89d1e8fc55d

memory/2664-512-0x0000000000400000-0x000000000041B000-memory.dmp

memory/992-510-0x0000000000400000-0x000000000041B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-12 10:34

Reported

2024-03-12 10:36

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lockbit

ransomware lockbit

Neshta

persistence spyware neshta

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Renames multiple (140) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\O957g99QW.bmp" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\O957g99QW.bmp" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedgewebview2.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\BHO\ie_to_edge_stub.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\cookie_exporter.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.17\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\pwahelper.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\O957g99QW\DefaultIcon\ = "C:\\ProgramData\\O957g99QW.ico" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.O957g99QW\ = "O957g99QW" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8

C:\ProgramData\F076.tmp

"C:\ProgramData\F076.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

memory/2600-1-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-12_5d65d61b82de6b9dcdb67a30cae300cd_darkside_neshta.exe

MD5 75e3d908fdddee413481dba88258783b
SHA1 4cd6c1a88f3575d298aa168356651d5237bb72ab
SHA256 36aae3ba1a6fd78e040bba4522f6c15d5a3627ae78b27ff6879ee64d038445a4
SHA512 d7c1e0bd3eb3888579ef696ea48ae4d83d70f08b3bafb23288a81ed40e1501513e2739af119c4a0f9d788f7aa4a6500df80260151a8eeeb7f6fe19fc5cf34256

memory/4592-11-0x00000000024B0000-0x00000000024C0000-memory.dmp

memory/4592-12-0x00000000024B0000-0x00000000024C0000-memory.dmp

memory/4592-13-0x00000000024B0000-0x00000000024C0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\LLLLLLLLLLL

MD5 ff2498f29ace334a0f1b0363329c98ab
SHA1 55b936414b4129d0b3d34ce3431e48fc4bf44067
SHA256 b8ae4e3bf4e920e62af051fe6910e204b59223becdb5dc97af6e347dcab53a48
SHA512 4bfd1deb5039115fe23eb1f334d539f8a5f8bc15de3b2f270d85afad73435ce6ad7df398dda967bde3c4cc1b1a31830637dc9fa2f0683bc55e00b04c2fec68c8

F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD

MD5 be08733292f2b9a788823d67a076c1a1
SHA1 7cc863c695e4ce3bafc9ec87cbce0a8936f9e248
SHA256 3dfe1565de901139bb1761ae9a342f3e27c898c27cb2186daaa69a0a39c9a4aa
SHA512 53a7d455ae1f7d87b9e0cee06b378d48f3b0a99bd1652943df8648ab7e83c30dce9327e5f5f9ea333f5071ac87301eb90d5254d670dcb5a59fc4d85fb056cde5

C:\Users\O957g99QW.README.txt

MD5 af6c2fc04d6fb6eb424e08d4b45ce3b5
SHA1 fe7d78642acd874590ef935ccde60c589a27cc69
SHA256 9dac1c01e8c041a14aafe45131d333ec5761a1525eb5d0d4d15e19ff2431ca0e
SHA512 0a93f792be449b5f90c1deac8bcd461cf591c87bd05e339f1d465a19b9474a4002b02755afb14023d1eb4f2c531328a3674a5a1a09af654c2ae8c96de393b7ec

memory/2600-239-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2600-304-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4592-305-0x00000000024B0000-0x00000000024C0000-memory.dmp

memory/4592-306-0x00000000024B0000-0x00000000024C0000-memory.dmp

memory/4592-307-0x00000000024B0000-0x00000000024C0000-memory.dmp

memory/2600-308-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

memory/2600-352-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2600-416-0x0000000000400000-0x000000000041B000-memory.dmp

C:\ProgramData\F076.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1744-422-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/1744-423-0x00000000026F0000-0x0000000002700000-memory.dmp

memory/1744-424-0x00000000026F0000-0x0000000002700000-memory.dmp

memory/1744-425-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/1744-426-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 036b7458049043791575654e1b4b2f05
SHA1 e9a329378fc5939cb584429272aa418cbce5d281
SHA256 ffa3cd3d5603affc3d7484bf8e05c8897d92b5fa087f481c6314ee854e088525
SHA512 811a4303285c6df96e9e4c2ea0d1772ba9a435bbfd3919c2b03afa9024672aa55379ffc5f7f5406eaebf7d85b98f47f155ad6f0880a70a69e9296edd8644f98c

memory/2600-455-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2600-456-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2600-457-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1744-458-0x00000000026F0000-0x0000000002700000-memory.dmp

memory/1744-459-0x00000000026F0000-0x0000000002700000-memory.dmp

memory/2600-461-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2600-462-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2600-463-0x0000000000400000-0x000000000041B000-memory.dmp