File name:	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit
Full analysis:	https://app.any.run/tasks/d931fba7-02dc-4688-9821-2f15e7712d70
Verdict:	Malicious activity
Threats:	LockBit, a ransomware variant, encrypts data on infected machines, demanding a ransom payment for decryption. Used in targeted attacks, It's a significant risk to organizations. Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	April 20, 2025, 15:08:03
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	ransomware stealer lockbit
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	971B1C13E0EFCB5B4FF57B5C67DFF89F
SHA1:	ED70FF12BEB69EDE3E6EB7EE9416AD0A091FF2F2
SHA256:	F4B0E3079B13B0C117D358461348E4B15986B4B9173504605BC3035C53527DF1
SSDEEP:	3072:RmhXodguLP/5qUpfDT6zT735yYbXlub2PQfkwPdoo6:dKzZ7l7zwPK/

.dll	\|	Win32 Dynamic Link Library (generic) (38.3)
.exe	\|	Win32 Executable (generic) (26.2)
.exe	\|	Win16/32 Executable Delphi generic (12)
.exe	\|	Generic Win/DOS Executable (11.6)
.exe	\|	DOS Executable Generic (11.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2022:09:09 01:27:01+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	14.12
CodeSize:	99328
InitializedDataSize:	50688
UninitializedDataSize:	-
EntryPoint:	0x1946f
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI


(PID) Process:	(1072) dllhost.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:	write	Name:	SlowContextMenuEntries
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:	(5892) ShellExperienceHost.exe	Key:	\REGISTRY\A\{9b42674d-d2ef-c93f-16e5-4f3fc182aff7}\LocalState
Operation:	write	Name:	PeekBadges
Value: 5B005D0000006AC2A40B06B2DB01
(PID) Process:	(6752) SearchApp.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:	write	Name:	SafeSearchMode
Value: 1
(PID) Process:	(6752) SearchApp.exe	Key:	\REGISTRY\A\{4f051bdd-4d87-89b6-b7c1-8ee7e8b670eb}\LocalState
Operation:	write	Name:	BINGIDENTITY_PROP_USEREMAIL
Value: 0000CCB7FB3F06B2DB01
(PID) Process:	(6752) SearchApp.exe	Key:	\REGISTRY\A\{4f051bdd-4d87-89b6-b7c1-8ee7e8b670eb}\LocalState
Operation:	write	Name:	BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value: 0000CCB7FB3F06B2DB01
(PID) Process:	(6752) SearchApp.exe	Key:	\REGISTRY\A\{4f051bdd-4d87-89b6-b7c1-8ee7e8b670eb}\LocalState
Operation:	write	Name:	BINGIDENTITY_PROP_ACCOUNTTYPE
Value: 0000CCB7FB3F06B2DB01
(PID) Process:	(6752) SearchApp.exe	Key:	\REGISTRY\A\{4f051bdd-4d87-89b6-b7c1-8ee7e8b670eb}\LocalState
Operation:	write	Name:	BINGIDENTITY_PROP_ACCOUNTTYPE
Value: 4E006F006E0065000000CCB7FB3F06B2DB01
(PID) Process:	(6752) SearchApp.exe	Key:	\REGISTRY\A\{4f051bdd-4d87-89b6-b7c1-8ee7e8b670eb}\LocalState
Operation:	write	Name:	BINGIDENTITY_PROP_USEREMAIL
Value: 0000DA93324006B2DB01
(PID) Process:	(6752) SearchApp.exe	Key:	\REGISTRY\A\{4f051bdd-4d87-89b6-b7c1-8ee7e8b670eb}\LocalState
Operation:	write	Name:	BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value: 0000DA93324006B2DB01
(PID) Process:	(6752) SearchApp.exe	Key:	\REGISTRY\A\{4f051bdd-4d87-89b6-b7c1-8ee7e8b670eb}\LocalState
Operation:	write	Name:	BINGIDENTITY_PROP_ACCOUNTTYPE
Value: 0000DA93324006B2DB01

PID	Process	Filename		Type
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\Users\V86sTiCVN.README.txt		text
		MD5:5CC06873F65F73627E39F13DAE1FBF68	SHA256:4D8E20AC94FD15E5E45F533976F8675153AEC14A4A6A0EC4A6FA1E9BDA457860
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\V86sTiCVN.README.txt		text
		MD5:5CC06873F65F73627E39F13DAE1FBF68	SHA256:4D8E20AC94FD15E5E45F533976F8675153AEC14A4A6A0EC4A6FA1E9BDA457860
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\$Recycle.Bin\S-1-5-18\LLLLLLLLLLL		binary
		MD5:245680A837C4E7F165F92E12D4DFC54B	SHA256:1B23EC40714BD4B42D530DA812CFC152A562FE44B79D1C24D0066C568A18F994
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\$Recycle.Bin\S-1-5-18\MMMMMMMMMMM		binary
		MD5:245680A837C4E7F165F92E12D4DFC54B	SHA256:1B23EC40714BD4B42D530DA812CFC152A562FE44B79D1C24D0066C568A18F994
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\$Recycle.Bin\S-1-5-18\PPPPPPPPPPP		binary
		MD5:245680A837C4E7F165F92E12D4DFC54B	SHA256:1B23EC40714BD4B42D530DA812CFC152A562FE44B79D1C24D0066C568A18F994
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJ		binary
		MD5:245680A837C4E7F165F92E12D4DFC54B	SHA256:1B23EC40714BD4B42D530DA812CFC152A562FE44B79D1C24D0066C568A18F994
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\$Recycle.Bin\S-1-5-18\IIIIIIIIIII		binary
		MD5:245680A837C4E7F165F92E12D4DFC54B	SHA256:1B23EC40714BD4B42D530DA812CFC152A562FE44B79D1C24D0066C568A18F994
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\$Recycle.Bin\S-1-5-18\KKKKKKKKKKK		binary
		MD5:245680A837C4E7F165F92E12D4DFC54B	SHA256:1B23EC40714BD4B42D530DA812CFC152A562FE44B79D1C24D0066C568A18F994
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHH		binary
		MD5:245680A837C4E7F165F92E12D4DFC54B	SHA256:1B23EC40714BD4B42D530DA812CFC152A562FE44B79D1C24D0066C568A18F994
6972	2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit.exe	C:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGG		binary
		MD5:245680A837C4E7F165F92E12D4DFC54B	SHA256:1B23EC40714BD4B42D530DA812CFC152A562FE44B79D1C24D0066C568A18F994

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2104	svchost.exe	GET	200	2.16.241.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2104	svchost.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4024	RUXIMICS.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	104.126.37.176:443	https://www.bing.com/manifest/threshold.appcache	unknown	text	3.47 Kb	whitelisted
—	—	GET	200	104.126.37.171:443	https://www.bing.com/rp/0u2b9EXo8LdXut1MFm4AD0phBuM.br.js	unknown	binary	1.44 Kb	whitelisted
—	—	GET	200	104.126.37.155:443	https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init	unknown	html	129 Kb	whitelisted
—	—	POST	204	104.126.37.147:443	https://www.bing.com/threshold/xls.aspx	unknown	—	—	whitelisted
—	—	GET	200	104.126.37.139:443	https://www.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DyIrb3t-gQF4cnWyAbUBK6UBK7gB&or=w	unknown	binary	21.3 Kb	whitelisted
—	—	GET	200	104.126.37.171:443	https://www.bing.com/rb/16/jnc,nj/-M-8YWX0KlEtdAHVrkTvKQHOghs.js?bu=DicwgAGNAZQBlwGKAYMBhwHCAcUBMLoByAE&or=w	unknown	binary	22.0 Kb	whitelisted
—	—	GET	200	104.126.37.177:443	https://www.bing.com/rb/3D/ortl,cc,nc/AptopUBu7_oVDubJxwvaIprW-lI.css?bu=A4gCjAKPAg&or=w	unknown	text	15.5 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
2104	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4024	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2104	svchost.exe	2.16.241.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2104	svchost.exe	2.23.246.101:80	www.microsoft.com	Ooredoo Q.S.C.	QA	whitelisted
4024	RUXIMICS.exe	2.23.246.101:80	www.microsoft.com	Ooredoo Q.S.C.	QA	whitelisted
2104	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6752	SearchApp.exe	104.126.37.178:443	www.bing.com	Akamai International B.V.	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.104.136.2	whitelisted
google.com	142.250.185.142	whitelisted
crl.microsoft.com	2.16.241.12 2.16.241.19	whitelisted
www.microsoft.com	2.23.246.101	whitelisted
www.bing.com	104.126.37.178 104.126.37.177 104.126.37.128 104.126.37.176 104.126.37.179 104.126.37.136 104.126.37.185 104.126.37.171 104.126.37.139	whitelisted

General Info

2025-04-20_971b1c13e0efcb5b4ff57b5c67dff89f_darkside_elex_lockbit

971B1C13E0EFCB5B4FF57B5C67DFF89F

ED70FF12BEB69EDE3E6EB7EE9416AD0A091FF2F2

F4B0E3079B13B0C117D358461348E4B15986B4B9173504605BC3035C53527DF1

3072:RmhXodguLP/5qUpfDT6zT735yYbXlub2PQfkwPdoo6:dKzZ7l7zwPK/

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Known privilege escalation attack

Renames files like ransomware

[YARA] LockBit is detected

Steals credentials from Web Browsers

RANSOMWARE has been detected

SUSPICIOUS

Reads security settings of Internet Explorer

Write to the desktop.ini file (may be used to cloak folders)

INFO

Checks supported languages

Reads security settings of Internet Explorer

Reads the computer name

Reads the machine GUID from the registry

Process checks computer location settings

Create files in a temporary directory

Checks proxy server information

Reads the software policy settings

Creates files in the program directory

Creates files or folders in the user directory

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings