Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/04/2025, 14:47
Behavioral task
behavioral1
Sample
2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral2
Sample
2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe
Resource
win11-20250410-en
General
-
Target
2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe
-
Size
153KB
-
MD5
a40bbbdc17f188eb906dc09cb0556bc6
-
SHA1
1f582c3ba3157202357d11a5a5ede3a383d10d79
-
SHA256
251297b055aa4decdab1a1d8e14ea1331bcbe00974515a647f55b0e0c23e29f5
-
SHA512
772bd820e4a60413204f659a15ecf8fb2f4665022bba4fe24209923485fc3c54213402b4912b511f12bb2eeaf06577886aa2c7b06d2e8c45b747836f90472ae4
-
SSDEEP
3072:UqJogYkcSNm9V7DNMcdmiyZkjIVXlf3T:Uq2kc4m9tDvmiyZkju
Malware Config
Extracted
C:\ryNlsace9.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (548) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2512 D8CD.tmp -
Executes dropped EXE 1 IoCs
pid Process 2512 D8CD.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2211465213-323295031-1970282057-1000\desktop.ini 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2211465213-323295031-1970282057-1000\desktop.ini 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPmjeo7e92cxwelcqs74v64yl9c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPdczbfc057r1s2slz0yjmx1dy.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPlf8xo3fwy6ngrch0h0d19093c.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ryNlsace9.bmp" 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ryNlsace9.bmp" 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2512 D8CD.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Control Panel\Desktop 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2211465213-323295031-1970282057-1000\Control Panel\Desktop\WallpaperStyle = "10" 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ryNlsace9 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ryNlsace9\ = "ryNlsace9" 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9\DefaultIcon 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ryNlsace9\DefaultIcon\ = "C:\\ProgramData\\ryNlsace9.ico" 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp 2512 D8CD.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeDebugPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: 36 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeImpersonatePrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeIncBasePriorityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeIncreaseQuotaPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: 33 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeManageVolumePrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeProfSingleProcessPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeRestorePrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSystemProfilePrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeTakeOwnershipPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeShutdownPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeDebugPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE 5668 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2536 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 86 PID 1072 wrote to memory of 2536 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 86 PID 1632 wrote to memory of 5668 1632 printfilterpipelinesvc.exe 89 PID 1632 wrote to memory of 5668 1632 printfilterpipelinesvc.exe 89 PID 1072 wrote to memory of 2512 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 90 PID 1072 wrote to memory of 2512 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 90 PID 1072 wrote to memory of 2512 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 90 PID 1072 wrote to memory of 2512 1072 2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe 90 PID 2512 wrote to memory of 224 2512 D8CD.tmp 91 PID 2512 wrote to memory of 224 2512 D8CD.tmp 91 PID 2512 wrote to memory of 224 2512 D8CD.tmp 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-17_a40bbbdc17f188eb906dc09cb0556bc6_darkside_elex_lockbit.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2536
-
-
C:\ProgramData\D8CD.tmp"C:\ProgramData\D8CD.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D8CD.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:224
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4864
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{396F802C-5AD0-42F4-AC6D-341F303C780F}.xps" 1338937486968200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5668
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55b29f8f875e5884cd50d2b0d78e11a4a
SHA1506306954d75d9b10f3c0ed540ac1f5788f6f01a
SHA25632ce674fb8b8783dc0dce03d5275bdc8d55fc1028a343be1783dc692e8cfa9f2
SHA5129cccdd2f9af11b889a9ae1cc403ab4ab558e0013f3bf88a92d7486cf7ff08cc35590035e692ba87898ee6d5426bd00fc28e72ac048f79d2708a28318b50b59f6
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
Filesize153KB
MD56b151a0e40b16192f71111a1955f6cd8
SHA1eae40d710c7a3380cbe139932ddceafed15cfb28
SHA2566c600da172ca81b4de3465b49567a8418ae39e4f95a716b6c71ba7ad1e9453f3
SHA5128fa184db60c31ff3ddb8dc59d3f49cf51a808df30de1ae896fc2f78b6bbd1ef34bb6023f466d5646c91ed28adb0be354221dd67d62e7a08746b0e2925da9a1c1
-
Filesize
4KB
MD5aa80b83ca13191f59e4379bdfdabf870
SHA12695fd07e872a2bc2c424d6c2f0036a45ce3995f
SHA25665586998772015a6c80d882928b5a4c1bfcc6da64f1b11324eeb34a4433645bc
SHA5128b43d74a200fd98581d2275bdac1cccad77955dbe98abb0e42f114148d6ee6de61be6346894aa0f5f57f6142405437f653068058ed50c9f9942558b2447fc345
-
Filesize
4KB
MD52c0c4cba3d513ad56149bd5d25e7b922
SHA14f15bf945f1ab5c6d8901a58f158eab9fa4641c8
SHA25601ebc0fa30c3f90486be974b2037eaa5756aa79b5cc992ab74b290990c09d343
SHA51285676df3778a234acd1edd182e433e9d7ab474338d901781e7b81e4917d7ba361692693c304b57aa29fdab39f18eca87764e3365ea139f262b9832aedc64a24a
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
129B
MD58cfa0036ead078efeaa13af7a1a9b251
SHA1174c40b4ecd2aa0a00407d52238d6642817cd53d
SHA2560637028e1c7e55ea425b8fb01346ce7641f728dbd148ed5374f635dd4bb055eb
SHA512f5e89b522e18bc37e2b25e263eb1006474cd3bb2c7ebbabc483147ab7dbe508f4e59c67a9096d93e14278df47f39610d8f3096719b09159757c7edefbe7530ed