Malware Analysis Report

2025-05-05 20:48

Sample ID 250420-ty4ctatlt4
Target 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit
SHA256 37bd15c4b02a4e8271590ca9d448e1340cbbdda44ea3f46f199bf2c047c33dff
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

37bd15c4b02a4e8271590ca9d448e1340cbbdda44ea3f46f199bf2c047c33dff

Threat Level: Known bad

The file 2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Lockbit family

Lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (638) files with added filename extension

Renames multiple (557) files with added filename extension

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Deletes itself

Indicator Removal: File Deletion

Drops desktop.ini file(s)

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Modifies registry class

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

Modifies Control Panel

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-20 16:28

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-20 16:28

Reported

2025-04-20 16:31

Platform

win10v2004-20250410-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (638) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2362875047-775336530-2205312478-1000\Control Panel\International\Geo\Nation C:\ProgramData\CFB5.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\CFB5.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\CFB5.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2362875047-775336530-2205312478-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2362875047-775336530-2205312478-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PPdtx03t0ai1zec0zlq0sir58fb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPz9jnnhe3mpcl7xz_094c6dq_d.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPgra1dbsv_oqekdqp864ph3thb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2362875047-775336530-2205312478-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\mXWb45OeA.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2362875047-775336530-2205312478-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\mXWb45OeA.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\CFB5.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\CFB5.tmp N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2362875047-775336530-2205312478-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2362875047-775336530-2205312478-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA\ = "mXWb45OeA" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon\ = "C:\\ProgramData\\mXWb45OeA.ico" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3080 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 3080 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 5340 wrote to memory of 4488 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 5340 wrote to memory of 4488 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3080 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\CFB5.tmp
PID 3080 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\CFB5.tmp
PID 3080 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\CFB5.tmp
PID 3080 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\CFB5.tmp
PID 1724 wrote to memory of 5856 N/A C:\ProgramData\CFB5.tmp C:\Windows\SysWOW64\cmd.exe
PID 1724 wrote to memory of 5856 N/A C:\ProgramData\CFB5.tmp C:\Windows\SysWOW64\cmd.exe
PID 1724 wrote to memory of 5856 N/A C:\ProgramData\CFB5.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{256AFADA-E456-455B-8F33-7238DEF9C577}.xps" 133896401425590000

C:\ProgramData\CFB5.tmp

"C:\ProgramData\CFB5.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CFB5.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/3080-2-0x00000000012A0000-0x00000000012B0000-memory.dmp

memory/3080-1-0x00000000012A0000-0x00000000012B0000-memory.dmp

memory/3080-0-0x00000000012A0000-0x00000000012B0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2362875047-775336530-2205312478-1000\DDDDDDDDDDD

MD5 fbdc55edb9c10fe2c7da86254379b64c
SHA1 c4be8bf2fe8073ace0b277afdfd77b4773f72e2c
SHA256 a448694a7f794fe9434f14ce0bfba880073e4043021dee5ef145086189030b22
SHA512 dbc5f4ce32f55715808a9230bb9ad8d5c5a0601f2d935ad6174733a8575f86d189ab544e9f57e3810c31eee877cb7c14bfe7d6c5b3955f4aaf99dd7a8493160b

C:\mXWb45OeA.README.txt

MD5 e12c3e76989a7451c92361766841accf
SHA1 4f353ec2e0705c1b71ed09103826f4411bfd6795
SHA256 91f0dfc9cafba8636fd896e09ed5fbf39f53e86aa101787c62528ed73f91dacd
SHA512 eeaca05d83ba0ef4624b0b63a82b485d2f5bb456e9b919807cc74334d37ec2688fbe9eb8620b2d4e8d4373ce7612948f893390d154a849714e00d4c9f4a5b5ac

F:\$RECYCLE.BIN\S-1-5-21-2362875047-775336530-2205312478-1000\DDDDDDDDDDD

MD5 257c1547e694cb3c4c4352c95f0f92d4
SHA1 f20b9e9659e2711ac82a43ee5abc6c33080f8789
SHA256 57784e6c0a3c53dc054037bdc3dc2882584924b36ea9f06007eb1186f04f50d5
SHA512 85d3d469046f28df5cfe9af2d004b0f6fb7abc0bffdafdbea4eac30644b0ddf0ec08ffb39cdcd558c5babd44e3fa2c18dac115f90d31b12b0e85ce532de21fc2

memory/3080-2970-0x00000000012A0000-0x00000000012B0000-memory.dmp

memory/3080-2971-0x00000000012A0000-0x00000000012B0000-memory.dmp

memory/3080-2972-0x00000000012A0000-0x00000000012B0000-memory.dmp

C:\ProgramData\CFB5.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4488-2988-0x00007FFCFC890000-0x00007FFCFC8A0000-memory.dmp

memory/4488-2989-0x00007FFCFC890000-0x00007FFCFC8A0000-memory.dmp

memory/4488-2990-0x00007FFCFC890000-0x00007FFCFC8A0000-memory.dmp

memory/4488-2991-0x00007FFCFC890000-0x00007FFCFC8A0000-memory.dmp

memory/4488-2992-0x00007FFCFC890000-0x00007FFCFC8A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 05144c13e44ddf84360e2bd0a249f055
SHA1 e4b3e9c8351f458c995c471ee716132233f3daf0
SHA256 bcee558d501f0936c003b66eda6d888d3345d3f1449ae20ef416b11f6b88b54b
SHA512 3ac37cb32c4f6cded10362769d388b861ef996954651a1748d45e792e3305e4c2dfcd6f6b7f1a37cb616ac3ba2c0e55363897bbcb84fb744bb7a3db200e4cd00

memory/4488-3021-0x00007FFCFA320000-0x00007FFCFA330000-memory.dmp

memory/4488-3022-0x00007FFCFA320000-0x00007FFCFA330000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{11F364D2-AA65-4F18-A8C2-AE9A5AE0523B}

MD5 bdc847491cda34076fac30f1b14d84b0
SHA1 88aee4cf7136dd70a23400dc90b073f14161eb40
SHA256 d808ee4d2769c2a07b39e1d148498f63eb3fea1795071b2e803c630345d507db
SHA512 40d114b7a8c257c35e2b2dcb8b906db2863b740145373ed8007fdab615cb6c41d112ddda283a63787ac5eed3dc15ca28c386e9c86acb8df70f7993cf10fe77f3

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 f5935ce50f12165a034ab349431b032c
SHA1 49013e5540c6b673662976f0ac27bddb59429968
SHA256 b34279950cdc96f9ece9d7c89b66d7889025be9afc73a0a3e6c8b80c5b8d6cb8
SHA512 5789c792999057cb2b2f8ee34fc60b5a3a9cf4cedf8f052dd215c0292db64ce3a1abb639b4bc8f532adf4ca145784b30a365ff82374b7d0a1767ec3fbcfdbc4b

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-20 16:28

Reported

2025-04-20 16:31

Platform

win11-20250410-en

Max time kernel

148s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (557) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\9DC7.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\9DC7.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-649025904-2769175349-3954215257-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-649025904-2769175349-3954215257-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPv8ha904tuejfhp5qu3n2qknxd.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPyz2egsh5k73fsgkk35ewcf3uc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPfprswgoovr0nx6e60jshb35lb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\mXWb45OeA.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\mXWb45OeA.bmp" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\9DC7.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\9DC7.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon\ = "C:\\ProgramData\\mXWb45OeA.ico" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mXWb45OeA\ = "mXWb45OeA" C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA\DefaultIcon C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mXWb45OeA C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1128 wrote to memory of 5876 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 1128 wrote to memory of 5876 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 3648 wrote to memory of 472 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3648 wrote to memory of 472 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1128 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\9DC7.tmp
PID 1128 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\9DC7.tmp
PID 1128 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\9DC7.tmp
PID 1128 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe C:\ProgramData\9DC7.tmp
PID 4992 wrote to memory of 4500 N/A C:\ProgramData\9DC7.tmp C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 4500 N/A C:\ProgramData\9DC7.tmp C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 4500 N/A C:\ProgramData\9DC7.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_04463f29330f85b617f686ca56f5d59c_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3648D7DB-C579-4006-9B8F-3444AFDA8E6B}.xps" 133896401416360000

C:\ProgramData\9DC7.tmp

"C:\ProgramData\9DC7.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9DC7.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/1128-1-0x0000000002B40000-0x0000000002B50000-memory.dmp

memory/1128-2-0x0000000002B40000-0x0000000002B50000-memory.dmp

memory/1128-0-0x0000000002B40000-0x0000000002B50000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-649025904-2769175349-3954215257-1000\BBBBBBBBBBB

MD5 f10680f2b45952f53409f32f27d85a09
SHA1 077b61aa674c433e846a7a578c50797364348f88
SHA256 8d7f16475721b3987f5de9e14f984e0be30ec714cea35f07e68e0117a7ae5dbd
SHA512 b1322982ffb7ef7d23fd26a521372b39e1d449455d391559a3b972f6d012525799be73348ee83bb508a40a0a03704e070790e760d557a4317b55d15d15d39b0e

F:\$RECYCLE.BIN\S-1-5-21-649025904-2769175349-3954215257-1000\DDDDDDDDDDD

MD5 531acbaa93d1c6f0625b21a973421619
SHA1 8ee0f417b6bc3985a19369c71a1f450157057acf
SHA256 ff69e39fe96ade2a45987995803b6bdd8a38b96ec97302d25cebf431966f7a9f
SHA512 207108c43eb32126b8ddc61812bd142c37f7c288dcd4ed5a8a1fb3f3ff8cfcd016412b5d6890e1a9becd6e3fc626c46b300622cef2ca09afd20842ff4c09e772

C:\Users\Admin\mXWb45OeA.README.txt

MD5 566693f5418692d4b0c374cbb14b9d8e
SHA1 c02d30f39f711ec72ce0481c57aecbef7d099fac
SHA256 db174c9e584a05ea3a412da565fbc4aed8dfdee3c824cdaca60b209b6521330b
SHA512 f8bebd5046e038f89d9fe1eab7601a5ddbacd58e53085b47c2ca8ede9f82d629cde9b245f650fa7e306fe6031bd1f99e34f63fa56ac2f29f62738748cd8e5233

memory/1128-3729-0x0000000002B40000-0x0000000002B50000-memory.dmp

memory/1128-3727-0x0000000002B40000-0x0000000002B50000-memory.dmp

memory/1128-3728-0x0000000002B40000-0x0000000002B50000-memory.dmp

C:\ProgramData\9DC7.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/472-3744-0x00007FFB98F10000-0x00007FFB98F20000-memory.dmp

memory/472-3746-0x00007FFB98F10000-0x00007FFB98F20000-memory.dmp

memory/472-3747-0x00007FFB98F10000-0x00007FFB98F20000-memory.dmp

memory/472-3748-0x00007FFB98F10000-0x00007FFB98F20000-memory.dmp

memory/472-3749-0x00007FFB98F10000-0x00007FFB98F20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

MD5 b2b9aae3cd41d28a57cdf271c19a8ae7
SHA1 31ea1c7647af364465ac57d9f1ec4becc825ae8a
SHA256 bc4d6a42fe05804376b424f92b89c13db20937e42d0f8f15df9aff24355f7200
SHA512 32168d700847104635029a2a1cc123dd76dc51c536041d62932c15c6c0c83004be5ee4060b68c774b4b8b4f774b786bea054d60fb49a91842cd9aaa44c021295

memory/472-3778-0x00007FFB96640000-0x00007FFB96650000-memory.dmp

memory/472-3779-0x00007FFB96640000-0x00007FFB96650000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{32EF2CD8-5F5B-47FD-920D-215DD55D27C4}

MD5 38d69ad1bd99b2d44f76c8b504a90a45
SHA1 edb24eefbfa94a94bb2daff7e3fdbaef82e752da
SHA256 783a06937c53e1a9c98cffaa0a213d6788d9eb980e550f9c0c7509e7317626d9
SHA512 8086d4fe6c406b62062a89f25557d95dc1dadeba6b2334bd30538b332a9d843a185d587888bbfd55e68a14c60320241f4dad5844dd20151503d573ee0435a1db

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 74fdfd88debb7bf0fcc08d875ee73be5
SHA1 be0b8354b216fa57ec2e2cdc4082ce930713535f
SHA256 6906ad962ea7382f3ff49edb5f0990fc409a19d622ce0e9f72989a926477cc9f
SHA512 c2febce221a91aac38da1e2a87bbe725c7b30dcd90013a9296700ba96bed08e80ee7675578f147249e4a4a065990624c2b3104a36e206ac948683b6135bcb3a0