Overview

overview

10

Static

static

3

2026-06-27...ex.exe

windows10-2004-x64

10

2026-06-27...ex.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 05:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe
  • Size 72KB
  • Sample260629-fx2wpse13n
  • SHA256 781c4928af5c7bb24db6ab1521b229fac5ae629295ba7d62507afe93546d67d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverydarksidepersistenceransomwarespywaretrojan

Malware Config

Extracted

Path

  • C:\Recovery\README.881846d1.TXT

  • darkside

Ransom Note
  • ----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 500GB data. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I When you open our website, put the following data in the input form: Key: I3tBdXvJ3pOvnhgmupZAJ7BpD5IVUftr7deEdtoxwK0QcbZciUXfs5ChjD0Yj8H2wUXfctFHYShVQHWhwi1CBDRQVPgXqnCgVRQql7B1tS8Q6TSdHq5o0UxOaDrdKCoMCdrMZiw0RTbfpDpuRwLI52rP5YaqZx492wErocN9C7PE6eFQEcqwqiFNA1FwVD3fogTJqOdTJI84FnlCBuRd1ippdTk8y2x16ukfPvVHi4MhyU8i4K1Q25a7wXQUPXhIffgZBnTimLzalSGyaI3f2MlQeYbpFG2o4nfnZCHDMAZAUY6CaiR0eAYVEvesreMmimT1EOyGYjNVtGHrJYXuRI4tYZIVlsHm6Ord42NV9s9PftLGkO8NBScZ9dBTNtz0xw9tpgu8GegVTlMesg6xkUAQWJcy6MNt9nJ7lHydpu27bA1GL8MX8lWAldnClSoUrDYRc8RAZ1oUfMfbtmvMDBGVENh8kMUYaxOt7hD1HxKFn0p5XcCDzWRSWkKUTtt7C6OiIpNOUAYYJ3UvC5S3uoXmt4iokkGq1SSMnr7sXmnekmh9oNwJgh7 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

  • http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I

Signatures

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside
  • Renames multiple (127) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 16 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 45 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1476
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe"
      2⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5968
      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe
        C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe -work worker0 job0-5968
        3⤵
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3948
      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe
        C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe -work worker1 job1-5968
        3⤵
        • Enumerates connected drives
        PID:992
      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe
        C:\Users\Admin\AppData\Local\Temp\2026-06-27_8ac57b6a41b99e2ced11641191545aba_darkside_elex.exe -work worker1 job1-5968
        3⤵
        • Enumerates connected drives
        PID:3308
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2328
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3920
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3868
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        README.881846d1.TXT
        • Path C:\Recovery\README.881846d1.TXT
        • Size 2KB
        • SHA256 5dfc11166e6b0e978aa5b95aaf2a51733033379b7e7980f5fa1d42b6333cf9e0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BACKUPINITIALIZE.DIB.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\BACKUPINITIALIZE.DIB.881846D1
        • Size 298KB
        • SHA256 58c562995bb067843fe0594450118eacbdeab8e34a68bad251a0f7ddb3b6bb25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        COMPAREWRITE.TXT.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\COMPAREWRITE.TXT.881846D1
        • Size 327KB
        • SHA256 e39c195cf90746664050abf6db27ff7d3f197390119def4c5bfa91b96eeb0d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        COMPLETESEND.DVR-MS.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\COMPLETESEND.DVR-MS.881846D1
        • Size 227KB
        • SHA256 5d0fbf9eb5e07b78c8b7e33a68c501379e5b93311a4c41dacb8c1f21bf25a163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DEBUGNEW.DOCX.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\DEBUGNEW.DOCX.881846D1
        • Size 199KB
        • SHA256 d458d525fc818b0e31efa5f9670a102cdeffaf3275833149bf4a7b1a21593e2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EXITSTOP.RAW.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\EXITSTOP.RAW.881846D1
        • Size 284KB
        • SHA256 97ed84713c324fd0dd7f4c0318fd83dbb588a75da9ff24e2f9869de2b0e7f1e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EXPORTCOMPRESS.PNG.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\EXPORTCOMPRESS.PNG.881846D1
        • Size 668KB
        • SHA256 34a5402ad83f995eae337dbedc8a2a931effff22fd03fc9a274777c2908da95f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GETREQUEST.M2V.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\GETREQUEST.M2V.881846D1
        • Size 170KB
        • SHA256 fe5e504cfbb0bccea72384e8d1cc1fc7bac4efa7b0196c24c6f024ceca420b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INVOKECOMPLETE.MP2V.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\INVOKECOMPLETE.MP2V.881846D1
        • Size 426KB
        • SHA256 9e3d1d5faf26b28049ec895a645d0104fc7fff9beff599a7b742c7ac5f1493c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INVOKEFORMAT.SEARCH-MS.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\INVOKEFORMAT.SEARCH-MS.881846D1
        • Size 369KB
        • SHA256 c9f580d899d3e363e3ba67cbf76c13c6e54eb6e7b76c39c036623f61b66609dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        JOINWRITE.WPS.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\JOINWRITE.WPS.881846D1
        • Size 441KB
        • SHA256 e767a7e57bb8941db0660c51659367213e18377005e31430edb29ea6bbbdb677
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOCKSYNC.DOCX.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\LOCKSYNC.DOCX.881846D1
        • Size 17KB
        • SHA256 b7524b39f655845fd53a8d163d45764c5972296d3050037d87a7008c34c13c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        READRECEIVE.ODT.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\READRECEIVE.ODT.881846D1
        • Size 469KB
        • SHA256 7f520f571c1e606ca41611fad24a9c32e0eda0753d79b9932d720dbde43d233d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        REPAIRREMOVE.XLSB.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\REPAIRREMOVE.XLSB.881846D1
        • Size 241KB
        • SHA256 9d9db949de1e0ba14f523a3c52eb57547b39ee5b9327b7413b89c80f4e8d37a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        REQUESTDISCONNECT.MHTML.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\REQUESTDISCONNECT.MHTML.881846D1
        • Size 455KB
        • SHA256 b8ef834a60080dec62bf91d6a046c003b09359f989cb9cf981aadaeb6f638bb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESOLVEMOUNT.MTS.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\RESOLVEMOUNT.MTS.881846D1
        • Size 483KB
        • SHA256 f61be18784db95ca501afa1bb439188d817d59de3b1a8602f19ee090608552e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESUMECHECKPOINT.OGG.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\RESUMECHECKPOINT.OGG.881846D1
        • Size 256KB
        • SHA256 36643f850d838cdb7b1b2756bfbfcb4651f1dcd7f762b5e6e96ff966703675bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RESUMEFIND.CR2.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\RESUMEFIND.CR2.881846D1
        • Size 270KB
        • SHA256 e9fbc6be3004409edeef510da662a01a94b401e908cd0a24ee0f37a61df40ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        STARTWATCH.XLT.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\STARTWATCH.XLT.881846D1
        • Size 355KB
        • SHA256 dbb99315c613c0ea13942f3e928dcce3f14b2699f083cbae91b0770393c77092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        STOPSYNC.DVR.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\STOPSYNC.DVR.881846D1
        • Size 185KB
        • SHA256 643d8ebdfd5294eb3c9cb0e34505625e2c8d8ee6d08c0ee834bb15322583da45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SUBMITTRACE.MOV.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\SUBMITTRACE.MOV.881846D1
        • Size 412KB
        • SHA256 51402aa81f30e73b4848112acce29b4c584a98b1c7d85ecaee04e5eca010ea07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SYNCSUSPEND.MPV2.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\SYNCSUSPEND.MPV2.881846D1
        • Size 341KB
        • SHA256 863cca178837494821cd6f91d0854d87036bc109cf243b2deb1e4db02e84e16d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TRACEOPEN.ODT.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\TRACEOPEN.ODT.881846D1
        • Size 313KB
        • SHA256 d5449fad5443aa1c87bf8c1df5d8d1e34135cf4e91c4602d9ead27d8a2527946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        USEUNDO.VSSX.881846D1
        • Path C:\USERS\ADMIN\DESKTOP\USEUNDO.VSSX.881846D1
        • Size 213KB
        • SHA256 85f93508e8e5d2bc75aaf2afce18855d1ae3f16bfa1c278bb2ae3f26cfef54ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini
        • Path \Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-2289519114-2956110270-1748446682-1000\desktop.ini
        • Size 129B
        • SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3868-245-0x000001A3001E0000-0x000001A3002E0000-memory.dmp
        Download

        memory/3868-266-0x000001A303920000-0x000001A303940000-memory.dmp
        Download

        memory/3868-270-0x000001A303B60000-0x000001A303B80000-memory.dmp
        Download

        memory/3868-267-0x000001A303D20000-0x000001A303E20000-memory.dmp
        Download

        memory/3868-308-0x000001A314050000-0x000001A314070000-memory.dmp
        Download

        memory/3920-417-0x000000000DCB0000-0x000000000E52B000-memory.dmp
        Download