Malware Analysis Report

2024-11-15 07:22

Sample ID 240313-2gzbjadc55
Target 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside
SHA256 bb7acad97b896bb0d93ee982046b2f9dba1fcb391130c18ec0f4a7e1d792c50f
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bb7acad97b896bb0d93ee982046b2f9dba1fcb391130c18ec0f4a7e1d792c50f

Threat Level: Known bad

The file 2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (315) files with added filename extension

Renames multiple (591) files with added filename extension

Reads user/profile data of web browsers

Deletes itself

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops desktop.ini file(s)

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Checks processor information in registry

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies Control Panel

Modifies registry class

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 22:33

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 22:33

Reported

2024-03-13 22:36

Platform

win7-20240221-en

Max time kernel

118s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (315) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\AE87.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\AE87.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ybRiTB9wP.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ybRiTB9wP.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\AE87.tmp N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ybRiTB9wP C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ybRiTB9wP\ = "ybRiTB9wP" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP\DefaultIcon\ = "C:\\ProgramData\\ybRiTB9wP.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe"

C:\ProgramData\AE87.tmp

"C:\ProgramData\AE87.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AE87.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x154

Network

N/A

Files

memory/1920-0-0x00000000022E0000-0x0000000002320000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1658372521-4246568289-2509113762-1000\BBBBBBBBBBB

MD5 97125f6de87f7035cce6a571312fc665
SHA1 797ef5cca3ce592a7cbd27048010e9d72ccfced4
SHA256 077c7080d4c29731aaf8174890c07b820d86ea7ad5dfcbbc2a9f92c9c85431bc
SHA512 38ae49d5c33d631bf27a8715908d4301722d1c1760eb96cd36dcca917cedc6d7a5683d4e355cc3e5ae0218172c7fe399f2180c0289d92c96a3715769579b9b40

C:\ybRiTB9wP.README.txt

MD5 3d76fce32c70b69cfe7741ef8e77e6b0
SHA1 50be438224cd1a3b63a654d24a0f30023495e53e
SHA256 121a34dc218f6f1004fa3932713957b8c4fcdec8ec3d699cb3700578e845fa5c
SHA512 0c7c67795ebd9986076c7766c34c1cee48aff642ffd5ae05edab9f2b08997452092951739d0e5054a3a804abb65256ebb79a524f0182bdd61754ba6b4b26b1fb

F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\DDDDDDDDDDD

MD5 1f15658592b6fba1c6a0b25467d2e92e
SHA1 ba99c210e4707ce77791f88ff1dde1823313adc5
SHA256 7a0c7d04039164473a3c52122012d7eef9f378deebf779f2ccf30ca4953718cc
SHA512 b8cdbf0bb400fd51677f7d940f19909c588c6e1a468e100686a1e134513e7c0c500aba28022dcc089f55b754ac032330e2629e816572610021f47cf7663ca33d

\ProgramData\AE87.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2824-833-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2824-834-0x0000000002070000-0x00000000020B0000-memory.dmp

memory/2824-835-0x0000000002070000-0x00000000020B0000-memory.dmp

memory/2824-839-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2824-842-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

MD5 044ce2f29878af6d304eb6ad9b729ff2
SHA1 134569d9f3584557989acd85669a3d9a10ac0b12
SHA256 98ba626c81876ab3c7885295cbf087c889e9464139290dc7f68ba38580a80b4a
SHA512 75c214b0348958f5c51b24abd29209feec8974f8404b066b0fb5d6590341005aa4805e35f28fbe55a7ae1706da89e4633d3a4cae519f4f9b64ee6edeaa5cb749

memory/2824-867-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/2824-866-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 22:33

Reported

2024-03-13 22:36

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (591) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\ProgramData\6523.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\6523.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\6523.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP_ujd56tmohg84mvd2531wvaed.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP69likqz0z06thb86bnr80z4oc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPmcqi1wk9q0d6_u2wdl0ssx0ed.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ybRiTB9wP.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ybRiTB9wP.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\6523.tmp N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ybRiTB9wP\DefaultIcon\ = "C:\\ProgramData\\ybRiTB9wP.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ybRiTB9wP C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ybRiTB9wP\ = "ybRiTB9wP" C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4700 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe C:\Windows\splwow64.exe
PID 4700 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe C:\Windows\splwow64.exe
PID 3996 wrote to memory of 4344 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3996 wrote to memory of 4344 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4700 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe C:\ProgramData\6523.tmp
PID 4700 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe C:\ProgramData\6523.tmp
PID 4700 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe C:\ProgramData\6523.tmp
PID 4700 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe C:\ProgramData\6523.tmp
PID 744 wrote to memory of 1740 N/A C:\ProgramData\6523.tmp C:\Windows\SysWOW64\cmd.exe
PID 744 wrote to memory of 1740 N/A C:\ProgramData\6523.tmp C:\Windows\SysWOW64\cmd.exe
PID 744 wrote to memory of 1740 N/A C:\ProgramData\6523.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_be4bc91ee9da747823a17fcd60f8e5b0_darkside.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{96B4B657-6CDD-4EA3-BBAA-41EAEB591EC7}.xps" 133548428438460000

C:\ProgramData\6523.tmp

"C:\ProgramData\6523.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6523.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 195.177.78.104.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 41.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 55.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 45.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 64.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4700-0-0x0000000002C10000-0x0000000002C20000-memory.dmp

memory/4700-1-0x0000000002C10000-0x0000000002C20000-memory.dmp

memory/4700-2-0x0000000002C10000-0x0000000002C20000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-399997616-3400990511-967324271-1000\AAAAAAAAAAA

MD5 e4cb7da1d6892a0d39d41c15f4abfd30
SHA1 e18793d21f46cc511225f91ca342fecd4688209f
SHA256 6788737e01c96377b8d59db8369282cf2ea78082e9a399a9d9c350348e42511e
SHA512 e382c0b916470ce4650546ae32e1ece3c8a8e9010b2a80b23f048f1115b478ad8bf9d829c327a60b46b360a7322c221727047dd75bbdbe714d9cace2b6b47f6c

F:\$RECYCLE.BIN\S-1-5-21-399997616-3400990511-967324271-1000\DDDDDDDDDDD

MD5 e934c23b5e62835fb7462065dba6362b
SHA1 78750298e553065db587e1e8760b2d5370bbc1b3
SHA256 88333bd8a42d65e0f8f4325205deb9091e966ee9407c86cf8f98f3da7ddedc98
SHA512 fdb8012774e593e6afc24466d9c8ebeeca0202474ba361d73cdc9a91fe85a7c86f59d4af058aa86b4cc5ca5468c2c8fafb246f0a48266312c20a718fc05a526a

C:\ybRiTB9wP.README.txt

MD5 5fa98154acd55d228bab7f71d8b506c9
SHA1 748e9978e246817d65e8adeb1856b642f9d789f5
SHA256 11338a9a6d757970014deed8b654e1fac2d2a2ca7f277e1f24f71f2c36b0f170
SHA512 a7690f136b046c226a58f329b3730a2998ea0be2ac7a68c8a0c44d77ebeb17392f8f4b1a2abbf574daf3e675d41a0d6765dd27e280808bd08875df831b258f4c

C:\ProgramData\6523.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4344-2761-0x00007FF95E350000-0x00007FF95E360000-memory.dmp

memory/4344-2762-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

MD5 d9c1ee96e29eac114e5436ce2564bb5a
SHA1 ba997d8e04b46d234d96ec63292ebf44f9c2e5fa
SHA256 6efb7c7e67cb0e327b6e89ff62d2db55940ac9778a1ece3e530a7d9fc992f82f
SHA512 0c72e6b744fdc566f43592e156fbc55c8c1f52eb0f97ff97334b6a7dc36bafe2271bf67bd4d42cd279ca963545beca02c39c62f54e78d602b98ed786a01fc955

memory/4344-2792-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2772-0x00007FF95E350000-0x00007FF95E360000-memory.dmp

memory/4344-2793-0x00007FF95E350000-0x00007FF95E360000-memory.dmp

memory/4344-2794-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2795-0x00007FF95E350000-0x00007FF95E360000-memory.dmp

memory/744-2798-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/4344-2796-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2797-0x00007FF95E350000-0x00007FF95E360000-memory.dmp

memory/744-2799-0x00000000025B0000-0x00000000025C0000-memory.dmp

memory/744-2800-0x00000000025B0000-0x00000000025C0000-memory.dmp

memory/744-2801-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/744-2802-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

memory/4344-2803-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2804-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2806-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2805-0x00007FF95C050000-0x00007FF95C060000-memory.dmp

memory/4344-2807-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2808-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2809-0x00007FF95C050000-0x00007FF95C060000-memory.dmp

memory/4344-2810-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2811-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2812-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 432571ec8997abd663d968d8fecfe93b
SHA1 4e98ded360ee318da03ffbc152634637fb987476
SHA256 7754ac27a9edb5f22bf5011f8c9947499501a91ae33eb1ca85dad453683149cd
SHA512 87b15435c510fbd1365612ac2a349581062f85389aae6b09d38315157c7fe4bf0a7675bae2b29058332c53e5cdc929563e3a927bf949d62cb111074e7a39fac8

memory/4344-2834-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp

memory/4344-2835-0x00007FF99E2D0000-0x00007FF99E4C5000-memory.dmp