Resubmissions
06/06/2025, 14:39
250606-r1hssabj4x 1006/06/2025, 05:05
250606-fqv5kswxaw 1006/06/2025, 04:54
250606-fjmvmawwe1 1005/06/2025, 17:23
250605-vyd9csfj4z 1005/06/2025, 15:18
250605-spt74sen5t 1005/06/2025, 15:06
250605-sg43cazmv9 1005/06/2025, 15:02
250605-seepnsyyet 1002/06/2025, 10:32
250602-mkxjsayzbv 10Analysis
-
geolocation tags
nanew-jerseynorth-americaunited-statesususa -
max time kernel
746s -
max time network
465s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2025, 15:18
Behavioral task
behavioral1
Sample
2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe
-
Size
148KB
-
MD5
cb6845218d57d663976bf1fa2a4d6ddb
-
SHA1
0635c1f6cece23efe1df63de9cb72715c123cbaa
-
SHA256
7855bee142c5abc5a3aa7f58a6a43cfb85df05d94fbb3a07bfe83cb73cf81281
-
SHA512
f0eff1a4c9a338ef2dece334d19fc9ef6ab421722e901ff0200de74e6df55594bca3abc43cebd0753fee47f71143e45097e74472b6e2b8b17e2bb28525ff5ea0
-
SSDEEP
3072:46glyuxE4GsUPnliByocWepVfB4vN2H7/yXHKR9W4cn:46gDBGpvEByocWe3fB2NO7gP4
Malware Config
Extracted
C:\g0Bwcr1Ri.README.txt
https://qtox.github.io/
Signatures
-
Renames multiple (699) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\International\Geo\Nation BE8E.tmp -
Deletes itself 1 IoCs
pid Process 3960 BE8E.tmp -
Executes dropped EXE 1 IoCs
pid Process 3960 BE8E.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1153236273-2212388449-1493869963-1000\desktop.ini 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1153236273-2212388449-1493869963-1000\desktop.ini 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPlu3c6e_wvkht5athwwr4qzrob.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPwlxs3z_007io6jpezy6s78x3c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPufa2rn5vivj09x6ifmifoq1yc.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\g0Bwcr1Ri.bmp" 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\g0Bwcr1Ri.bmp" 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 3960 BE8E.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\WallpaperStyle = "10" 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.g0Bwcr1Ri 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.g0Bwcr1Ri\ = "g0Bwcr1Ri" 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\g0Bwcr1Ri\DefaultIcon 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\g0Bwcr1Ri 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\g0Bwcr1Ri\DefaultIcon\ = "C:\\ProgramData\\g0Bwcr1Ri.ico" 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp 3960 BE8E.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeDebugPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: 36 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeImpersonatePrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeIncBasePriorityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeIncreaseQuotaPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: 33 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeManageVolumePrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeProfSingleProcessPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeRestorePrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSystemProfilePrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeTakeOwnershipPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeShutdownPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeDebugPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeBackupPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe Token: SeSecurityPrivilege 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE 1100 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2164 wrote to memory of 3704 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 92 PID 2164 wrote to memory of 3704 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 92 PID 3104 wrote to memory of 1100 3104 printfilterpipelinesvc.exe 99 PID 3104 wrote to memory of 1100 3104 printfilterpipelinesvc.exe 99 PID 2164 wrote to memory of 3960 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 100 PID 2164 wrote to memory of 3960 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 100 PID 2164 wrote to memory of 3960 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 100 PID 2164 wrote to memory of 3960 2164 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe 100 PID 3960 wrote to memory of 1584 3960 BE8E.tmp 101 PID 3960 wrote to memory of 1584 3960 BE8E.tmp 101 PID 3960 wrote to memory of 1584 3960 BE8E.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3704
-
-
C:\ProgramData\BE8E.tmp"C:\ProgramData\BE8E.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BE8E.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1584
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3192
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1045A5D2-84DC-4C72-8975-3C467F4B4C76}.xps" 1339361054521100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1100
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5bc5e43fcb25afd56df2ca6d8858d3b46
SHA1fc64070c6a761e86f6a77442202fe7406719b5cb
SHA256a7ed43ae8017a35384e59c4c5931176d47ae81beaebd1f04dd68e59fc0d2615a
SHA5125acd44044a2eda97f137b6210d31c13b131dbfd8a17f08d03aba7f8f7ffbeaa2398f004de579817297eabcc1fddaa799fced033e4a41bd57f98c20be83cdf7c0
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize148KB
MD59cbdf12cf9251688d40d946624e309a5
SHA15b23529becdd0c5dcdac7468474e3db33542929b
SHA25615fcab8cbbb4e6f6451c7fe9b85cd8a56fdb606ef1c1607ca42a29a79e3e01dd
SHA5122e090ca54625ef13706cfc43b30e1d182774094845ea71d922d3e4c1007f0aa6db8ba35bf1d7c387b6cd61f143433e311c5f0353c0f606fb2d1483757a071ad5
-
Filesize
4KB
MD5898b89c79c293866088e839fd36e90c1
SHA1c3be7e90dc0a471d323f2273840255a26b976921
SHA256d316274f87664942fd9df797802320a4a22f01aa00f4c6d15b700bbaa4939857
SHA512dd3f3f1c11b370d686da18d4a81372018077be08d273c194ae1843da54adc0628ea0f5f9a0cede17b0140c34b36993343ab6dbd0294dc74933172d78871cdf9c
-
Filesize
4KB
MD5a6d1bed83277557c33a83a9fb3f0ec89
SHA10c7d74e6a1bd075ffb41d310efc2d6684e6ce383
SHA2567aeb433c054610d042bb4ef3a5296d451fabef97317becb1fad65ffc996ca40e
SHA512557bdeb0a2369f78f06821228b4cd33788e3e857300b9f2ad55cc34f8a2920db57103e97475eb27f7d0e2ee07fa1f635dc407361ce63fd10c72cf6a6517d6579
-
Filesize
2KB
MD5b10fb6a4fb075eb70221d3a644ddc1c8
SHA170f57d7359875e2b3d13d019791468a27da07b7b
SHA256cd7d12a8b250b5102d534cabdc2375f57871608338da8852f705d57bd47cecb5
SHA5125737bc6be99c636f05fd2380f575c5de29bf6f9d6b723ca904678e78fce99fcf7b2c4e51c69b56b78fae1e192dba72bba2f2694d607340c074d2b3b600dd2dbe
-
Filesize
129B
MD512ebda9d3882d04c3905f0bd1d8c46fe
SHA1f2266d168d583c55b4a0403d5da7903c38500d40
SHA256325c5878d545887bd5f1c574c842781c8cf5ca2b62804595656dda91a836bf86
SHA5124860a888856278a330be198f1ab762e57c89388b917a7c54e36c7eaf4b24a220a95e3bafd3ec2828ec34291a2ce1f1c01d5b3c43a8ff2e55c7ec128e2f70eb00