Resubmissions
08/09/2026, 18:11
260908-wsm5rawepa1008/09/2026, 18:03
260908-wndqhswejh1024/08/2026, 15:28
260824-swnznshr9z10Analysis
- max time kernel
49s - max time network
44s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/09/2026, 18:11
Errors
General
- Target 2026-08-23_25532db6842c7f66eca77d3909470179_coinminer_darkside_elex_lockbit.exe
- Size 152KB
- Sample260908-wsm5rawepa
- SHA256 d84e02fad67a4a04402966fdbf2618dd08a86ea81500d638f30f1061b4c72104
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Control Panel 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_25532db6842c7f66eca77d3909470179_coinminer_darkside_elex_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_25532db6842c7f66eca77d3909470179_coinminer_darkside_elex_lockbit.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\8785.tmp"C:\ProgramData\8785.tmp"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
KKKKKKKKKKK
8785.tmp
DDDDDDDDDDD
memory/1536-0-0x0000000002F80000-0x0000000002F90000-memory.dmp
memory/1536-2-0x0000000002F80000-0x0000000002F90000-memory.dmp
memory/1536-1-0x0000000002F80000-0x0000000002F90000-memory.dmp
memory/6564-90-0x000000007FE70000-0x000000007FE71000-memory.dmp
memory/6564-92-0x000000007FE10000-0x000000007FE11000-memory.dmp
memory/6564-91-0x0000000002680000-0x0000000002690000-memory.dmp
memory/6564-88-0x000000007FE90000-0x000000007FE91000-memory.dmp
memory/6564-89-0x0000000002680000-0x0000000002690000-memory.dmp
memory/6564-93-0x0000000002680000-0x0000000002690000-memory.dmp
memory/6564-94-0x0000000002680000-0x0000000002690000-memory.dmp