Malware Analysis Report

2024-11-15 07:21

Sample ID 240313-a4fddshf83
Target 2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside
SHA256 8732b3934981357a625f425af08731a6bb5fc00f3a957dd4518de98cf84d08d7
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8732b3934981357a625f425af08731a6bb5fc00f3a957dd4518de98cf84d08d7

Threat Level: Known bad

The file 2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit family

Lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Deletes itself

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Modifies Control Panel

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-13 00:45

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-13 00:45

Reported

2024-03-13 00:48

Platform

win7-20240221-en

Max time kernel

121s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\1796.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\1796.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1650401615-1019878084-3673944445-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1650401615-1019878084-3673944445-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\z9VLivqzH.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\z9VLivqzH.bmp" C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\z9VLivqzH\DefaultIcon\ = "C:\\ProgramData\\z9VLivqzH.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z9VLivqzH C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.z9VLivqzH\ = "z9VLivqzH" C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\z9VLivqzH\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\z9VLivqzH C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe"

C:\ProgramData\1796.tmp

"C:\ProgramData\1796.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1796.tmp >> NUL

Network

N/A

Files

memory/3012-0-0x0000000002150000-0x0000000002190000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1650401615-1019878084-3673944445-1000\desktop.ini

MD5 0817cc220a866ce6a8c20e36be65f928
SHA1 d8a1786c8969a1dcca72db4e46e8317c03cf4422
SHA256 10bf6920a4deefe4458cd6d7f7c73fa03c264f4b856088f792f8c29577898a88
SHA512 075834ac463a881512eb3d7e4b71352bf45a55d8c0ece9d4ec49c0ee200f4bb32f5868189b1a38d6ba5cec691660c502779765e59a84eab25907c26698610494

C:\Users\Admin\z9VLivqzH.README.txt

MD5 db54ef7fcad3bea4d20c8e06f051e2e0
SHA1 9bdc405763cb34d3e06f8eeac8fab8807495a15e
SHA256 10fa497a565b006d336b1c02f9bc1fcb799559d2f2b699cc78dcf5cf3991e6f7
SHA512 6ac1283aaeac11611ad6a06aa8ee5bd55a8110e072539407c058c467c52ed255cd152ab9d282ebb460db8b4414e39bffdb3e180943f2311411e19b06b07b059b

F:\$RECYCLE.BIN\S-1-5-21-1650401615-1019878084-3673944445-1000\DDDDDDDDDDD

MD5 f0628149bb0e148b335886c978481467
SHA1 6894701a12246c4ad32ab55563b56584137f061a
SHA256 3792718679a60e153fad3eeab98052760ecb17c2ac897758e7d1cb22f14d1944
SHA512 ee46766e87eab9ba07b28f7080deb9300a825effc12a27b70a9f0e64f610a4d8be0e91c600f5276b5491ba0f8c01e698dcd12f9d8b912c949c4bac4c7ecad64a

\ProgramData\1796.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2908-870-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2908-892-0x00000000003B0000-0x00000000003F0000-memory.dmp

memory/2908-895-0x00000000003B0000-0x00000000003F0000-memory.dmp

memory/2908-896-0x000000007EF80000-0x000000007EF81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

MD5 bbd5de6febc728af7a9f8039fcb2442f
SHA1 52ee04700dbb70e096412917dd45033ffaea0153
SHA256 49ea955576b153152372582a0866498e50fbc894d48c658402933926ffd37c81
SHA512 3df1d5a1340b5224266efb11d34c32f4acb916fd8facb50bc8030c1770d3d6a64152f115edf119e9cb8f356517264f7458c7c63364f88ac47272c474eb921f99

memory/2908-897-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2908-903-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/2908-904-0x000000007EF60000-0x000000007EF61000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-13 00:45

Reported

2024-03-13 00:48

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe"

Signatures

Lockbit

ransomware lockbit

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\z9VLivqzH\DefaultIcon\ = "C:\\ProgramData\\z9VLivqzH.ico" C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z9VLivqzH C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.z9VLivqzH\ = "z9VLivqzH" C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\z9VLivqzH\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\z9VLivqzH C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe

"C:\Users\Admin\AppData\Local\Temp\2024-03-13_f28a75de3d39b47c7529146ea4195e6b_darkside.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
GB 92.123.128.161:443 www.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 161.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.16.208.104.in-addr.arpa udp

Files

memory/2612-0-0x0000000001100000-0x0000000001110000-memory.dmp

memory/2612-1-0x0000000001100000-0x0000000001110000-memory.dmp

memory/2612-2-0x0000000001100000-0x0000000001110000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini

MD5 6415508a4eace0407d66957910bf121f
SHA1 45422a83be67cec21ea199c6fb16489e5007388f
SHA256 cb5f355cc32a9c2ebb946d35246bee7bb93e59bb13b23a2926ffb6974e0d29a5
SHA512 3bc1623a8703557882bd0a058e87d430bf258c6a9731f171ec7d98428fb30d0b784a80775edef7fe7b6223347dfd626c00b1efab8853e479fe58dc97a8c19fb9

C:\z9VLivqzH.README.txt

MD5 31b33dc2926af4e46899e5bb4568a893
SHA1 7098cce13c2430c31f86434dbc7af8f265fdc841
SHA256 11e36014dcaa851f35ddd153fb29bfa0f7c2864ef60e6e55ce9884cccc11fe38
SHA512 f2bdaa4fcdb39afbb8c7a82ec6ee3121705576a68ea9d56d0096bac73c07eff511606e63f860ebe3224df378a60b224640a3d709486a09d58679648342e3af4a

F:\$RECYCLE.BIN\S-1-5-21-2727153400-192325109-1870347593-1000\DDDDDDDDDDD

MD5 7684b78fd37b870f6d57d39b363d9a15
SHA1 7faf010fcc4635faffb3e158a7ce820724842ec6
SHA256 3292c118268b5de28e4bdef6550c3310302e2b2927acfbace938d3578dcf0bf1
SHA512 97a240280e5f0490445acf88c2532981e5e4ead5b5e58b73efb5cbdb05bd54e01fbc02245a456b1f70246672a1ef31b6ba848954d46c70bfc4f428a2cc5ff95c

memory/2612-2605-0x0000000001100000-0x0000000001110000-memory.dmp

memory/2612-2606-0x0000000001100000-0x0000000001110000-memory.dmp

memory/2612-2607-0x0000000001100000-0x0000000001110000-memory.dmp