General
-
Target
2025-04-23_ed6fa9757400a0de9596d59bd0262ebd_darkside_elex_lockbit
-
Size
160KB
-
Sample
250423-rdpmtaztas
-
MD5
ed6fa9757400a0de9596d59bd0262ebd
-
SHA1
0836c5ab9bed96b1d9618bc802792185c6ee21ca
-
SHA256
daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397
-
SHA512
37d93ce4b1796d205d090390645fa149181b99fa7a67c0afcfa548851644659dde27b169049f7f5bfc73e63bc448a59746236e1e6b47335d58a6b0eddd356412
-
SSDEEP
3072:bDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368a0y5zxm8yNB41ctER6ptQtR2:15d/zugZqll3bQzmB3tQt5L
Behavioral task
behavioral1
Sample
2025-04-23_ed6fa9757400a0de9596d59bd0262ebd_darkside_elex_lockbit.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral2
Sample
2025-04-23_ed6fa9757400a0de9596d59bd0262ebd_darkside_elex_lockbit.exe
Resource
win11-20250410-en
Malware Config
Targets
-
-
Target
2025-04-23_ed6fa9757400a0de9596d59bd0262ebd_darkside_elex_lockbit
-
Size
160KB
-
MD5
ed6fa9757400a0de9596d59bd0262ebd
-
SHA1
0836c5ab9bed96b1d9618bc802792185c6ee21ca
-
SHA256
daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397
-
SHA512
37d93ce4b1796d205d090390645fa149181b99fa7a67c0afcfa548851644659dde27b169049f7f5bfc73e63bc448a59746236e1e6b47335d58a6b0eddd356412
-
SSDEEP
3072:bDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368a0y5zxm8yNB41ctER6ptQtR2:15d/zugZqll3bQzmB3tQt5L
Score9/10-
Renames multiple (147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-