Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/04/2025, 15:05
Behavioral task
behavioral1
Sample
2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral2
Sample
2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe
Resource
win11-20250410-en
General
-
Target
2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe
-
Size
153KB
-
MD5
971b1c13e0efcb5b4ff57b5c67dff89f
-
SHA1
ed70ff12beb69ede3e6eb7ee9416ad0a091ff2f2
-
SHA256
f4b0e3079b13b0c117d358461348e4b15986b4b9173504605bc3035c53527df1
-
SHA512
f82956ae6ce0110fe3670a04484f802473247d051faa56e7fccfe352812f291d70b49a477e6e73cd3da416d8434752617f8e6833f8aa78524f6a46881649ac40
-
SSDEEP
3072:Q6glyuxE4GsUPnliByocWepKQiPCNK6bs44:Q6gDBGpvEByocWekovA44
Malware Config
Extracted
C:\V86sTiCVN.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (572) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 3704 85CB.tmp -
Executes dropped EXE 1 IoCs
pid Process 3704 85CB.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-599783296-1627459723-2423478968-1000\desktop.ini 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-599783296-1627459723-2423478968-1000\desktop.ini 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPdabsfas8q7mig03wshlk811y.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPinou02_muivi6x40nwtpb9a9.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPk2qe99mbj6fe9ts34d8zflqpd.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\V86sTiCVN.bmp" 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Set value (str) \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\V86sTiCVN.bmp" 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 3704 85CB.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Control Panel\Desktop 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Set value (str) \REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Control Panel\Desktop\WallpaperStyle = "10" 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN\DefaultIcon\ = "C:\\ProgramData\\V86sTiCVN.ico" 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.V86sTiCVN 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.V86sTiCVN\ = "V86sTiCVN" 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN\DefaultIcon 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\V86sTiCVN 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 2796 ONENOTE.EXE 2796 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp 3704 85CB.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeDebugPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: 36 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeImpersonatePrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeIncBasePriorityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeIncreaseQuotaPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: 33 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeManageVolumePrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeProfSingleProcessPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeRestorePrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSystemProfilePrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeTakeOwnershipPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeShutdownPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeDebugPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeBackupPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE 2796 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4480 wrote to memory of 3572 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 80 PID 4480 wrote to memory of 3572 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 80 PID 5348 wrote to memory of 2796 5348 printfilterpipelinesvc.exe 83 PID 5348 wrote to memory of 2796 5348 printfilterpipelinesvc.exe 83 PID 4480 wrote to memory of 3704 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 84 PID 4480 wrote to memory of 3704 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 84 PID 4480 wrote to memory of 3704 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 84 PID 4480 wrote to memory of 3704 4480 2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe 84 PID 3704 wrote to memory of 2388 3704 85CB.tmp 85 PID 3704 wrote to memory of 2388 3704 85CB.tmp 85 PID 3704 wrote to memory of 2388 3704 85CB.tmp 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3572
-
-
C:\ProgramData\85CB.tmp"C:\ProgramData\85CB.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\85CB.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2388
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2164
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{629350B6-8273-4BF8-A1CE-EB933E5E565B}.xps" 1338963512807400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2796
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD569d87b919b9fe7fd3b62e5306e5a55c3
SHA1d5653c793996812456084a5997d0083cbbe5548a
SHA25693139eab1d889a98f3c6ccd6c3a10a405daea804b14a91c5ac2aef18e2b44c02
SHA512dbf3e1dd9fe66cf8a46da447fa4b0a98cfaf11b82b22f163900012f3e1a279072b765b72eaac73b0fe5d11428a5f328801ec482737a11e5c7a45c30413c3f70d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
Filesize153KB
MD5fb0bed89c661b7f2b087edef676b1d2a
SHA1014a6e8ac12a39e3041c2babe227f3b8b75e92fa
SHA256a59ed90b3a6c175d19a41ff85fe86b02b2d052be27714ef6c5d39b32ced0d2a4
SHA512c1124a7ee3bf9bdb0354bffc88afcb1e6e545d16b81532aaa16f92c4f76d712abf5887cf177a918927e3c88a0477e6a1cc6d678ae2935e426643477d9eb9959e
-
Filesize
4KB
MD584da384d4283a3b7180c3159ce80a318
SHA1f6e71e413ec11117c7458b1f83d422f4157fab82
SHA25632a58d89b00f8a59da69e17fedd290c15f1b393c2053c101809b180baa84401d
SHA512ffcc95c64149d8cb7477208e70b5a0ce31e53a6c9e7af4d2678bf296a6bdf67a6b56e4c5494ee81f42118b34dced8cc292f7f975c9df6a1ba7ba0bbe231c9347
-
Filesize
4KB
MD54724194142c03315b9a15fb1e223cfb6
SHA1e2fa59c6988a75b6092c79ae77c5b18fe377a39c
SHA25611dda159db859d7f687b554db53e9c33fe9873c8071c603e54b723e65cda63ce
SHA512d19173119d0f26f8c7e1a64fe067158353d76624150e163ca8fe1404697ac59c3de722bdf6c5cd3d14eab7e8422cec05535d56f80b2a2a414d486b670e3c85d2
-
Filesize
6KB
MD5dab6b5b789e70f8b4d5ddc174c805ef6
SHA19bd3a2df3473c805a98a9bf68da1722191f7ea77
SHA25605ccec2895595faa16ab34ddc191704ae37a7614a2b1c5ff442e3c3b20aa7bf8
SHA512bb0d485cc7767b49f3957d0bfdee3ce778c59db3be19d5e47b7dc7d2a64ed3acb98a839a85dbda9f55773f874a11404218da032ddcd676cebbd195b336152993
-
Filesize
129B
MD55e7f1aeecdbe0834554de5f2ee71452f
SHA1dd1d96542cfe50981fbd97bcbec65f94148e756a
SHA256ad5170ce6813806e1b6068e06a8881da34ee85033b16c0fee4bed9c9a579ec6f
SHA5123a8034bf3ec9b36180d0d0dfdff01c680f7bce66e26e4935319094682016b0c38c0725cd370e22843c9ec2d5e5a312414db40945553efe153e6d26607e1485ee