Overview

overview

10

Static

static

10

2026-10-12...it.exe

windows10-2004-x64

9

2026-10-12...it.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/10/2026, 07:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-12_46cf9e9a8fe8299d981c6e26601d4a64_coinminer_darkside_elex_lockbit.exe
  • Size 146KB
  • Sample261012-jbfm5axy4k
  • SHA256 2157af59f5d46c874d0586e73d0cb746651923ad9059c30a216091a409f9f2f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (6005) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Deletes itself 1 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-12_46cf9e9a8fe8299d981c6e26601d4a64_coinminer_darkside_elex_lockbit.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-12_46cf9e9a8fe8299d981c6e26601d4a64_coinminer_darkside_elex_lockbit.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\ProgramData\74E8.tmp
      "C:\ProgramData\74E8.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:6356
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\74E8.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:7684

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        RRRRRRRRRRR
        • Path C:\$Recycle.Bin\S-1-5-21-1846164713-4096795028-774071693-1000\RRRRRRRRRRR
        • Size 129B
        • SHA256 9174d70b08e981240e5224ceafe1f1802eac7c353cdb721ea47dadf9359afc4b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ar_NEUTER.pak.LNdmiVLUP
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ar_NEUTER.pak.LNdmiVLUP
        • Size 18B
        • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
        • MD5 SHA1 SHA512
        Submit Download

        MSOUC_F_COL.HXK.LNdmiVLUP
        • Path C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.LNdmiVLUP
        • Size 114B
        • SHA256 3c3702253a4695b5bcb18a2565b1d49f9f32f5f9f2442fd1395197970fa34edb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        OUTLOOK_K_COL.HXK.LNdmiVLUP
        • Path C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_K_COL.HXK.LNdmiVLUP
        • Size 113B
        • SHA256 1c17b95e5098adb0c0e06aac8a8c7c50c6a5ef1b696465d548c8a922f1d3a653
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        YAHOO.HK.XML.LNdmiVLUP
        • Path C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.HK.XML.LNdmiVLUP
        • Size 1KB
        • SHA256 22e9461b9aed2d6b9b296e53171f14c940a33fe8f521807a5cb04402aa1f47c2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vlc.mo.LNdmiVLUP
        • Path C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.LNdmiVLUP
        • Size 771KB
        • SHA256 caa583f35e59e416a65eb0935dd67a507f37207136c6837f2e46618d7257e7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        74E8.tmp
        • Path C:\ProgramData\74E8.tmp
        • Size 14KB
        • SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat.LNdmiVLUP
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\Settings\settings.dat.LNdmiVLUP
        • Size 8KB
        • SHA256 07d15ba50642afdcd25df8902ac595420515157f55ac627e0ea199d26d494672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134336138845678263.txt.LNdmiVLUP
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336138845678263.txt.LNdmiVLUP
        • Size 64KB
        • SHA256 c4b0df6a326bc88e7b991b3f1c08968fd4ab71430e1775f6fbbe14726b7dc091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134336141590401363.txt.LNdmiVLUP
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336141590401363.txt.LNdmiVLUP
        • Size 85KB
        • SHA256 53f53fc0502a6647b26b66893ca82dabafd02d1e7aa82c717e4034cb72907754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
        • Path C:\Users\Admin\AppData\Local\Temp\BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
        • Size 146KB
        • SHA256 63c45cf9b0f2a277e3eca0680a0170821b4ce0b25f66c686f5097128245da75a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlockDebug.mpg.LNdmiVLUP
        • Path C:\Users\Admin\Downloads\BlockDebug.mpg.LNdmiVLUP
        • Size 757KB
        • SHA256 90e896d9d1e6a41a1f166a18349cdcaf08a9230dbd851b190bf0b044828094a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloseClear.dot.LNdmiVLUP
        • Path C:\Users\Admin\Downloads\CloseClear.dot.LNdmiVLUP
        • Size 335KB
        • SHA256 ccf46b128afa048f95feac19d37b3bd0a19126c59190a3951bf4d3f6097ca151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LNdmiVLUP.README.txt
        • Path C:\Users\Admin\Downloads\LNdmiVLUP.README.txt
        • Size 701B
        • SHA256 864cfba810153ff3023f40b921023521cd42efb6b27a310d6a6749b6d2e12e9d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BBBBBBBBBBB
        • Path F:\$RECYCLE.BIN\S-1-5-21-1846164713-4096795028-774071693-1000\BBBBBBBBBBB
        • Size 129B
        • SHA256 c11410e624ec43e33ffa5e5aa7da3b0896e9ce2bd58fd0fd1a855354b3ec22fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4604-0-0x00000000026C0000-0x00000000026D0000-memory.dmp
        Download

        memory/4604-7411-0x00000000026C0000-0x00000000026D0000-memory.dmp
        Download

        memory/4604-7410-0x00000000026C0000-0x00000000026D0000-memory.dmp
        Download

        memory/4604-1-0x00000000026C0000-0x00000000026D0000-memory.dmp
        Download

        memory/4604-2-0x00000000026C0000-0x00000000026D0000-memory.dmp
        Download

        memory/4604-7409-0x00000000026C0000-0x00000000026D0000-memory.dmp
        Download

        memory/6356-19591-0x00000000023F0000-0x0000000002400000-memory.dmp
        Download

        memory/6356-19648-0x000000007FE00000-0x000000007FE01000-memory.dmp
        Download

        memory/6356-19647-0x000000007FDE0000-0x000000007FDE1000-memory.dmp
        Download

        memory/6356-19646-0x000000007FDC0000-0x000000007FDC1000-memory.dmp
        Download

        memory/6356-19643-0x000000007FE20000-0x000000007FE21000-memory.dmp
        Download

        memory/6356-19590-0x000000007FE40000-0x000000007FE41000-memory.dmp
        Download