legionlocker | 188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-09-2022 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
Size

3.4MB
MD5

35acbf4b0e8cfe8b9c3c2d5da5eb0131
SHA1

bc2d3b96b8f5d227b41611f64216753a898e804c
SHA256

188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99
SHA512

381f3a0867207e9824a1382620c17d1b445e307512982279a285e7cb4ce2f79a7f48b549d5c78e0f1ef707ff10ec249784a1d6e88788eba1e861f492f19fe2ca
SSDEEP

98304:NUqA6Sp+ZIogCxfwijqisUzS5Q1J6KtqxxwwpJKILMW:JAOC/MINxxVpEp

Score

10^/10

legionlocker evasion ransomware themida trojan

Malware Config

Signatures

Detected LegionLocker ransomware 3 IoCs

Sample contains strings associated with the LegionLocker family.

ransomware

resource	yara_rule
behavioral1/files/0x00090000000126f1-56.dat	family_legionlocker
behavioral1/files/0x00090000000126f1-58.dat	family_legionlocker
behavioral1/files/0x00090000000126f1-62.dat	family_legionlocker

LegionLocker
Ransomware family active in 2021.
ransomware legionlocker

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LegionL0cker.exe

Executes dropped EXE 1 IoCs

pid	Process
932	LegionL0cker.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ConfirmUnregister.png => C:\Users\Admin\Pictures\ConfirmUnregister.png.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\EditPublish.raw => C:\Users\Admin\Pictures\EditPublish.raw.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\JoinGrant.raw => C:\Users\Admin\Pictures\JoinGrant.raw.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\LimitConvertFrom.raw => C:\Users\Admin\Pictures\LimitConvertFrom.raw.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\PingSelect.raw => C:\Users\Admin\Pictures\PingSelect.raw.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\TestUse.raw => C:\Users\Admin\Pictures\TestUse.raw.lock	LegionL0cker.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LegionL0cker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LegionL0cker.exe

Loads dropped DLL 1 IoCs

pid	Process
1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00090000000126f1-56.dat	themida
behavioral1/files/0x00090000000126f1-58.dat	themida
behavioral1/files/0x00090000000126f1-62.dat	themida
behavioral1/memory/932-66-0x0000000000A30000-0x000000000129C000-memory.dmp	themida
behavioral1/memory/932-67-0x0000000000A30000-0x000000000129C000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LegionL0cker.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
932	LegionL0cker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
1768	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	LegionL0cker.exe
Token: SeDebugPrivilege	1768	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 932	1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe	28
PID 1080 wrote to memory of 932	1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe	28
PID 1080 wrote to memory of 932	1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe	28
PID 1080 wrote to memory of 932	1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe	28
PID 932 wrote to memory of 1084	932	LegionL0cker.exe	29
PID 932 wrote to memory of 1084	932	LegionL0cker.exe	29
PID 932 wrote to memory of 1084	932	LegionL0cker.exe	29
PID 932 wrote to memory of 1084	932	LegionL0cker.exe	29
PID 1084 wrote to memory of 1768	1084	cmd.exe	31
PID 1084 wrote to memory of 1768	1084	cmd.exe	31
PID 1084 wrote to memory of 1768	1084	cmd.exe	31
PID 1084 wrote to memory of 1768	1084	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe
  "C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Modifies extensions of user files
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k color 47 && taskkill /f /im explorer.exe && Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe

Filesize
3.1MB

MD5
d48b80eadbbe9bfb68f3fbe11a6cf0e5

SHA1
c099a07b701c1f06709e181481a5938f9b6e001a

SHA256
4cfb6842146846fca052d82cc0f80e23c3a7b23bd5958aecfa6a21e28825a1f0

SHA512
18aede3c47814d5a53dafaeab24da4a322ac8ed079640938cba4027903c07e524fee6f7746d0fdfc996bc9ad208441c6f11565fe56d603567d7cdefe4f8389ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe

Filesize
3.1MB

MD5
d48b80eadbbe9bfb68f3fbe11a6cf0e5

SHA1
c099a07b701c1f06709e181481a5938f9b6e001a

SHA256
4cfb6842146846fca052d82cc0f80e23c3a7b23bd5958aecfa6a21e28825a1f0

SHA512
18aede3c47814d5a53dafaeab24da4a322ac8ed079640938cba4027903c07e524fee6f7746d0fdfc996bc9ad208441c6f11565fe56d603567d7cdefe4f8389ea

Download Submit
\Users\Admin\AppData\Local\Temp\LegionL0cker.exe

Filesize
3.1MB

MD5
d48b80eadbbe9bfb68f3fbe11a6cf0e5

SHA1
c099a07b701c1f06709e181481a5938f9b6e001a

SHA256
4cfb6842146846fca052d82cc0f80e23c3a7b23bd5958aecfa6a21e28825a1f0

SHA512
18aede3c47814d5a53dafaeab24da4a322ac8ed079640938cba4027903c07e524fee6f7746d0fdfc996bc9ad208441c6f11565fe56d603567d7cdefe4f8389ea

Download Submit
memory/932-66-0x0000000000A30000-0x000000000129C000-memory.dmp

Filesize
8.4MB

Download
memory/932-71-0x0000000004EA5000-0x0000000004EB6000-memory.dmp

Filesize
68KB

Download
memory/932-74-0x0000000004EA5000-0x0000000004EB6000-memory.dmp

Filesize
68KB

Download
memory/932-61-0x0000000000A30000-0x000000000129C000-memory.dmp

Filesize
8.4MB

Download
memory/932-73-0x00000000777A0000-0x0000000077920000-memory.dmp

Filesize
1.5MB

Download
memory/932-72-0x0000000000A30000-0x000000000129C000-memory.dmp

Filesize
8.4MB

Download
memory/932-67-0x0000000000A30000-0x000000000129C000-memory.dmp

Filesize
8.4MB

Download
memory/932-68-0x00000000777A0000-0x0000000077920000-memory.dmp

Filesize
1.5MB

Download
memory/1080-54-0x00000000009D0000-0x0000000000D40000-memory.dmp

Filesize
3.4MB

Download
memory/1080-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1080-60-0x0000000005820000-0x000000000608C000-memory.dmp

Filesize
8.4MB

Download