f6289c13d79d8de611e9c143602298970b5969c15a4d6a3e40efec794bc371dd

General

Target

LegionLocker3.0.exe
Size

3.0MB
MD5

cdccf5b587aac1a4aeb53f8aaa465759
SHA1

3d804d15282a5b031684cc6bd8b9b7d9d880d13d
SHA256

f6289c13d79d8de611e9c143602298970b5969c15a4d6a3e40efec794bc371dd
SHA512

61668842acbb52c8c1e35e5ba4cca412ea1a56b4de6e3adb58f158cee77f8e04e24be99bbbc92c5f551afc2bbe45cf9c99c7b0b63affb8cef3d6718dc0c950f3

Score

10^/10

evasion ransomware spyware stealer themida trojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\LegionReadMe.txt

Ransom Note

Ooops! All your important files are encrypted! What happend to my computer? All your important files are encrypted. No one can help you to restore files without our special decryptor Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. Please don't forget to attach ID.txt file in the e-mail. To decrypt other files you have to pay $50. How do i pay? Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom of the sheet. Contact: 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us ([email protected]) In case of no anwser in 72 hours write us to this email: [email protected] What if i already paid? Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software, it may cause pernament data loss. Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

Emails

[email protected]

Wallets

131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

URLs

http://mail2tor2zyjdctd.onion/

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

LegionLocker3.0.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExportBlock.raw => C:\Users\Admin\Pictures\ExportBlock.raw.LGNLCKD	LegionLocker3.0.exe
File renamed	C:\Users\Admin\Pictures\SelectUnpublish.crw => C:\Users\Admin\Pictures\SelectUnpublish.crw.LGNLCKD	LegionLocker3.0.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LegionLocker3.0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LegionLocker3.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LegionLocker3.0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/3156-115-0x0000000001070000-0x0000000001071000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

LegionLocker3.0.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LegionLocker3.0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LegionLocker3.0.exe

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

LegionLocker3.0.exe

pid process

3156 LegionLocker3.0.exe

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
3280	vssadmin.exe
3968	vssadmin.exe
3976	vssadmin.exe
3724	vssadmin.exe
3032	vssadmin.exe
992	vssadmin.exe
1280	vssadmin.exe
2488	vssadmin.exe
3704	vssadmin.exe
3120	vssadmin.exe
2108	vssadmin.exe
2924	vssadmin.exe
3900	vssadmin.exe
2372	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

LegionLocker3.0.exe

pid	process
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe
3156	LegionLocker3.0.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

LegionLocker3.0.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3156	LegionLocker3.0.exe
Token: SeBackupPrivilege	2872	vssvc.exe
Token: SeRestorePrivilege	2872	vssvc.exe
Token: SeAuditPrivilege	2872	vssvc.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

LegionLocker3.0.execmd.exe

description	pid	process	target process
PID 3156 wrote to memory of 188	3156	LegionLocker3.0.exe	cmd.exe
PID 3156 wrote to memory of 188	3156	LegionLocker3.0.exe	cmd.exe
PID 3156 wrote to memory of 188	3156	LegionLocker3.0.exe	cmd.exe
PID 188 wrote to memory of 1280	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 1280	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 1280	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3280	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3280	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3280	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3120	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3120	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3120	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3968	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3968	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3968	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2108	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2108	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2108	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2924	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2924	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2924	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3900	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3900	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3900	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2372	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2372	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2372	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2488	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2488	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 2488	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3704	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3704	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3704	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3976	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3976	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3976	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3032	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3032	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3032	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3724	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3724	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 3724	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 992	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 992	188	cmd.exe	vssadmin.exe
PID 188 wrote to memory of 992	188	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\LegionLocker3.0.exe
"C:\Users\Admin\AppData\Local\Temp\LegionLocker3.0.exe"
1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WTHBNZD.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:188
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1280
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:3280
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:3120
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3968
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2108
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2924
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3900
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2372
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2488
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3704
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3976
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3032
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3724
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WTHBNZD.bat

MD5
d2aba3e1af80edd77e206cd43cfd3129

SHA1
3116da65d097708fad63a3b73d1c39bffa94cb01

SHA256
8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

SHA512
0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

Download Submit
\??\c:\Users\Admin\Downloads\BackupBlock.xls.LGNLCKD

MD5
734d66be453dd14cd756d64a4da29331

SHA1
7bf5fb4318b1f567617718868bdd3a6f206d6792

SHA256
ff3204fd3329b77cc12bf4d402dfc46c7a6cd51f85551b3a9313b41103dd9148

SHA512
710f26997966b62d5c5dd6fa14144590de8d3bf5fa6cce6d3f9617b39ed4041350197afa43146457cc12e81b2dc7652c6c1edaf0518f528211804670662d816c

Download Submit
memory/188-121-0x0000000000000000-mapping.dmp

Download
memory/992-138-0x0000000000000000-mapping.dmp

Download
memory/1280-123-0x0000000000000000-mapping.dmp

Download
memory/2108-129-0x0000000000000000-mapping.dmp

Download
memory/2372-132-0x0000000000000000-mapping.dmp

Download
memory/2488-133-0x0000000000000000-mapping.dmp

Download
memory/2924-130-0x0000000000000000-mapping.dmp

Download
memory/3032-136-0x0000000000000000-mapping.dmp

Download
memory/3120-127-0x0000000000000000-mapping.dmp

Download
memory/3156-120-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/3156-125-0x00000000055D0000-0x0000000005ACE000-memory.dmp

Filesize
5.0MB

Download
memory/3156-124-0x00000000055D0000-0x0000000005ACE000-memory.dmp

Filesize
5.0MB

Download
memory/3156-119-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/3156-118-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3156-117-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download
memory/3156-115-0x0000000001070000-0x0000000001071000-memory.dmp

Filesize
4KB

Download
memory/3280-126-0x0000000000000000-mapping.dmp

Download
memory/3704-134-0x0000000000000000-mapping.dmp

Download
memory/3724-137-0x0000000000000000-mapping.dmp

Download
memory/3900-131-0x0000000000000000-mapping.dmp

Download
memory/3968-128-0x0000000000000000-mapping.dmp

Download
memory/3976-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads