Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/04/2025, 16:28
Behavioral task
behavioral1
Sample
2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral2
Sample
2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe
Resource
win11-20250410-en
General
-
Target
2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe
-
Size
153KB
-
MD5
04463f29330f85b617f686ca56f5d59c
-
SHA1
73372115326cbe0309198207e089a93332f76f68
-
SHA256
37bd15c4b02a4e8271590ca9d448e1340cbbdda44ea3f46f199bf2c047c33dff
-
SHA512
75c2313576f2a970197d2d56fc64702848855f4e7bb0d42e38fd686e2530e883574a8b402deecb0ac6e1bb4349f81845f3d002e9c220da1758b31ccc18f60b64
-
SSDEEP
3072:NqJogYkcSNm9V7D/8BfUWQZ6g0HQ6PKhNJhoET:Nq2kc4m9tDqCvV6S/
Malware Config
Extracted
C:\Users\Admin\mXWb45OeA.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (557) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 4992 9DC7.tmp -
Executes dropped EXE 1 IoCs
pid Process 4992 9DC7.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-649025904-2769175349-3954215257-1000\desktop.ini 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-649025904-2769175349-3954215257-1000\desktop.ini 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPv8ha904tuejfhp5qu3n2qknxd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPyz2egsh5k73fsgkk35ewcf3uc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPfprswgoovr0nx6e60jshb35lb.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\mXWb45OeA.bmp" 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\mXWb45OeA.bmp" 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4992 9DC7.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Control Panel\Desktop 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Control Panel\Desktop\WallpaperStyle = "10" 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon\ = "C:\\ProgramData\\mXWb45OeA.ico" 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA\ = "mXWb45OeA" 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 472 ONENOTE.EXE 472 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp 4992 9DC7.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeDebugPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: 36 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeImpersonatePrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeIncBasePriorityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeIncreaseQuotaPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: 33 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeManageVolumePrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeProfSingleProcessPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeRestorePrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSystemProfilePrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeTakeOwnershipPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeShutdownPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeDebugPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeBackupPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE 472 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1128 wrote to memory of 5876 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 81 PID 1128 wrote to memory of 5876 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 81 PID 3648 wrote to memory of 472 3648 printfilterpipelinesvc.exe 84 PID 3648 wrote to memory of 472 3648 printfilterpipelinesvc.exe 84 PID 1128 wrote to memory of 4992 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 85 PID 1128 wrote to memory of 4992 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 85 PID 1128 wrote to memory of 4992 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 85 PID 1128 wrote to memory of 4992 1128 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe 85 PID 4992 wrote to memory of 4500 4992 9DC7.tmp 86 PID 4992 wrote to memory of 4500 4992 9DC7.tmp 86 PID 4992 wrote to memory of 4500 4992 9DC7.tmp 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:5876
-
-
C:\ProgramData\9DC7.tmp"C:\ProgramData\9DC7.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9DC7.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4500
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5296
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3648D7DB-C579-4006-9B8F-3444AFDA8E6B}.xps" 1338964014163600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:472
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5f10680f2b45952f53409f32f27d85a09
SHA1077b61aa674c433e846a7a578c50797364348f88
SHA2568d7f16475721b3987f5de9e14f984e0be30ec714cea35f07e68e0117a7ae5dbd
SHA512b1322982ffb7ef7d23fd26a521372b39e1d449455d391559a3b972f6d012525799be73348ee83bb508a40a0a03704e070790e760d557a4317b55d15d15d39b0e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
Filesize153KB
MD5b2b9aae3cd41d28a57cdf271c19a8ae7
SHA131ea1c7647af364465ac57d9f1ec4becc825ae8a
SHA256bc4d6a42fe05804376b424f92b89c13db20937e42d0f8f15df9aff24355f7200
SHA51232168d700847104635029a2a1cc123dd76dc51c536041d62932c15c6c0c83004be5ee4060b68c774b4b8b4f774b786bea054d60fb49a91842cd9aaa44c021295
-
Filesize
4KB
MD538d69ad1bd99b2d44f76c8b504a90a45
SHA1edb24eefbfa94a94bb2daff7e3fdbaef82e752da
SHA256783a06937c53e1a9c98cffaa0a213d6788d9eb980e550f9c0c7509e7317626d9
SHA5128086d4fe6c406b62062a89f25557d95dc1dadeba6b2334bd30538b332a9d843a185d587888bbfd55e68a14c60320241f4dad5844dd20151503d573ee0435a1db
-
Filesize
4KB
MD574fdfd88debb7bf0fcc08d875ee73be5
SHA1be0b8354b216fa57ec2e2cdc4082ce930713535f
SHA2566906ad962ea7382f3ff49edb5f0990fc409a19d622ce0e9f72989a926477cc9f
SHA512c2febce221a91aac38da1e2a87bbe725c7b30dcd90013a9296700ba96bed08e80ee7675578f147249e4a4a065990624c2b3104a36e206ac948683b6135bcb3a0
-
Filesize
6KB
MD5566693f5418692d4b0c374cbb14b9d8e
SHA1c02d30f39f711ec72ce0481c57aecbef7d099fac
SHA256db174c9e584a05ea3a412da565fbc4aed8dfdee3c824cdaca60b209b6521330b
SHA512f8bebd5046e038f89d9fe1eab7601a5ddbacd58e53085b47c2ca8ede9f82d629cde9b245f650fa7e306fe6031bd1f99e34f63fa56ac2f29f62738748cd8e5233
-
Filesize
129B
MD5531acbaa93d1c6f0625b21a973421619
SHA18ee0f417b6bc3985a19369c71a1f450157057acf
SHA256ff69e39fe96ade2a45987995803b6bdd8a38b96ec97302d25cebf431966f7a9f
SHA512207108c43eb32126b8ddc61812bd142c37f7c288dcd4ed5a8a1fb3f3ff8cfcd016412b5d6890e1a9becd6e3fc626c46b300622cef2ca09afd20842ff4c09e772