Overview

overview

10

Static

static

56b77a9c4d...33.exe

windows7-x64

10

56b77a9c4d...33.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220722-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2022, 01:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe
  • Size 224KB
  • Sample220725-ccl3zaabdr
  • SHA256 56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033
  • MD5 SHA1 SHA512
Score
10/10
lockbitransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Restore-My-Files.txt

Ransom Note
  • All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������69 E1 DB F5 0A 77 33 EF 7E 5C 1F 27 AD 2D 23 D8 F6 F7 5E 40 35 98 FC 50 71 BF EA 2F F6 D8 25 45 5F 64 28 DD BE 66 25 02 93 76 AE 1F 0B 1F D7 1A B7 9B 6F 98 63 98 62 A9 EB 4D FB 50 8E 9C 90 D3 58 96 48 D4 88 C1 06 FA 3A 9B 98 2E 5C C5 6E 83 E5 EB 02 F6 69 5F 57 39 1D CB 38 CD D6 DE 6A F3 C7 BD 86 1C 7D EB 11 23 D6 BB 55 F7 57 41 55 52 92 56 73 79 6B CF D9 18 59 12 04 48 C9 CF 78 81 A8 8E D7 60 91 FC 68 EC A1 BF 90 24 CA FC 39 E5 DE 5D 8F D3 18 71 BB AD 23 25 04 C2 EB 1A F9 BF DB AD CF C4 FC 3A 0C CE A5 96 4C CF 6D F8 C7 40 95 7D 6A A0 78 70 EA 33 80 1C 18 AE 3D 5B 08 EA A9 D0 8C 9A 98 02 3C 38 7C F8 09 7A C8 08 CD 6B F3 29 3E 23 95 91 5A AA 00 20 1B 08 F8 91 28 32 EC CE 6F 13 62 A0 57 F3 5E FF F2 36 44 73 AD 5E 67 AE A9 4A 32 AB 82 EA D1 64 07 6A F2 2B D0 F2 ###�������������
URLs

  • http://decrmbgpvh6kvmti.onion/

  • http://helpinfh6vj47ift.onion/

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 14 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe
    "C:\Users\Admin\AppData\Local\Temp\56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:1272
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:3128
    • C:\Users\Admin\AppData\Local\Temp\56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe
      "C:\Users\Admin\AppData\Local\Temp\56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • NTFS ADS
      PID:4860

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe
        • Path C:\Users\Admin\AppData\Local\Temp\56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033.exe
        • Size 224KB
        • SHA256 56b77a9c4d7a6359e9d813917c213dd40c571248bf040da37d76dd6227084033
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4304-134-0x0000000005720000-0x0000000005786000-memory.dmp
        Download

        memory/4304-136-0x00000000062E0000-0x00000000064A2000-memory.dmp
        Download

        memory/4304-137-0x0000000006A60000-0x0000000007004000-memory.dmp
        Download

        memory/4304-132-0x0000000000C90000-0x0000000000CCE000-memory.dmp
        Download

        memory/4304-139-0x0000000006210000-0x00000000062A2000-memory.dmp
        Download

        memory/4304-140-0x0000000001420000-0x00000000014BC000-memory.dmp
        Download

        memory/4304-133-0x0000000005660000-0x0000000005682000-memory.dmp
        Download

        memory/4860-142-0x0000000000400000-0x000000000040E000-memory.dmp
        Download

        memory/4860-145-0x0000000000400000-0x000000000040E000-memory.dmp
        Download

        memory/4860-146-0x0000000000400000-0x000000000040E000-memory.dmp
        Download