legionlocker | 188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99

General

Target

HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
Size

3.4MB
MD5

35acbf4b0e8cfe8b9c3c2d5da5eb0131
SHA1

bc2d3b96b8f5d227b41611f64216753a898e804c
SHA256

188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99
SHA512

381f3a0867207e9824a1382620c17d1b445e307512982279a285e7cb4ce2f79a7f48b549d5c78e0f1ef707ff10ec249784a1d6e88788eba1e861f492f19fe2ca
SSDEEP

98304:NUqA6Sp+ZIogCxfwijqisUzS5Q1J6KtqxxwwpJKILMW:JAOC/MINxxVpEp

Score

10^/10

legionlocker evasion ransomware themida trojan

Malware Config

Signatures

Detected LegionLocker ransomware 3 IoCs

Sample contains strings associated with the LegionLocker family.

ransomware

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\LegionL0cker.exe	family_legionlocker
C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe	family_legionlocker
C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe	family_legionlocker

LegionLocker
Ransomware family active in 2021.
ransomware legionlocker
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

LegionL0cker.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ LegionL0cker.exe
Executes dropped EXE 1 IoCs

Processes:

LegionL0cker.exe

pid process

932 LegionL0cker.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LegionL0cker.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

LegionL0cker.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConfirmUnregister.png => C:\Users\Admin\Pictures\ConfirmUnregister.png.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\EditPublish.raw => C:\Users\Admin\Pictures\EditPublish.raw.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\JoinGrant.raw => C:\Users\Admin\Pictures\JoinGrant.raw.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\LimitConvertFrom.raw => C:\Users\Admin\Pictures\LimitConvertFrom.raw.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\PingSelect.raw => C:\Users\Admin\Pictures\PingSelect.raw.lock	LegionL0cker.exe
File renamed	C:\Users\Admin\Pictures\TestUse.raw => C:\Users\Admin\Pictures\TestUse.raw.lock	LegionL0cker.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LegionL0cker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LegionL0cker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LegionL0cker.exe

Loads dropped DLL 1 IoCs

Processes:

HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe

pid process

1080 HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe

pid	process
1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\LegionL0cker.exe	themida
C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe	themida
C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe	themida
behavioral1/memory/932-66-0x0000000000A30000-0x000000000129C000-memory.dmp	themida
behavioral1/memory/932-67-0x0000000000A30000-0x000000000129C000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

LegionL0cker.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LegionL0cker.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

LegionL0cker.exe

pid process

932 LegionL0cker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1768 taskkill.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LegionL0cker.exe

pid	process
1768	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

LegionL0cker.exe

pid	process
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe
932	LegionL0cker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

LegionL0cker.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 932 LegionL0cker.exe
Token: SeDebugPrivilege 1768 taskkill.exe

description	pid	process
Token: SeDebugPrivilege	932	LegionL0cker.exe
Token: SeDebugPrivilege	1768	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exeLegionL0cker.execmd.exe

description	pid	process	target process
PID 1080 wrote to memory of 932	1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe	LegionL0cker.exe
PID 1080 wrote to memory of 932	1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe	LegionL0cker.exe
PID 1080 wrote to memory of 932	1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe	LegionL0cker.exe
PID 1080 wrote to memory of 932	1080	HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe	LegionL0cker.exe
PID 932 wrote to memory of 1084	932	LegionL0cker.exe	cmd.exe
PID 932 wrote to memory of 1084	932	LegionL0cker.exe	cmd.exe
PID 932 wrote to memory of 1084	932	LegionL0cker.exe	cmd.exe
PID 932 wrote to memory of 1084	932	LegionL0cker.exe	cmd.exe
PID 1084 wrote to memory of 1768	1084	cmd.exe	taskkill.exe
PID 1084 wrote to memory of 1768	1084	cmd.exe	taskkill.exe
PID 1084 wrote to memory of 1768	1084	cmd.exe	taskkill.exe
PID 1084 wrote to memory of 1768	1084	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.Encoder.vho-188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080

C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe
"C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k color 47 && taskkill /f /im explorer.exe && Exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1768

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe
Filesize
3.1MB

MD5
d48b80eadbbe9bfb68f3fbe11a6cf0e5

SHA1
c099a07b701c1f06709e181481a5938f9b6e001a

SHA256
4cfb6842146846fca052d82cc0f80e23c3a7b23bd5958aecfa6a21e28825a1f0

SHA512
18aede3c47814d5a53dafaeab24da4a322ac8ed079640938cba4027903c07e524fee6f7746d0fdfc996bc9ad208441c6f11565fe56d603567d7cdefe4f8389ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe
Filesize
3.1MB

MD5
d48b80eadbbe9bfb68f3fbe11a6cf0e5

SHA1
c099a07b701c1f06709e181481a5938f9b6e001a

SHA256
4cfb6842146846fca052d82cc0f80e23c3a7b23bd5958aecfa6a21e28825a1f0

SHA512
18aede3c47814d5a53dafaeab24da4a322ac8ed079640938cba4027903c07e524fee6f7746d0fdfc996bc9ad208441c6f11565fe56d603567d7cdefe4f8389ea

Download Submit
\Users\Admin\AppData\Local\Temp\LegionL0cker.exe
Filesize
3.1MB

MD5
d48b80eadbbe9bfb68f3fbe11a6cf0e5

SHA1
c099a07b701c1f06709e181481a5938f9b6e001a

SHA256
4cfb6842146846fca052d82cc0f80e23c3a7b23bd5958aecfa6a21e28825a1f0

SHA512
18aede3c47814d5a53dafaeab24da4a322ac8ed079640938cba4027903c07e524fee6f7746d0fdfc996bc9ad208441c6f11565fe56d603567d7cdefe4f8389ea

Download Submit
memory/932-66-0x0000000000A30000-0x000000000129C000-memory.dmp

Filesize
8.4MB

Download
memory/932-71-0x0000000004EA5000-0x0000000004EB6000-memory.dmp

Filesize
68KB

Download
memory/932-74-0x0000000004EA5000-0x0000000004EB6000-memory.dmp

Filesize
68KB

Download
memory/932-61-0x0000000000A30000-0x000000000129C000-memory.dmp

Filesize
8.4MB

Download
memory/932-73-0x00000000777A0000-0x0000000077920000-memory.dmp

Filesize
1.5MB

Download
memory/932-72-0x0000000000A30000-0x000000000129C000-memory.dmp

Filesize
8.4MB

Download
memory/932-67-0x0000000000A30000-0x000000000129C000-memory.dmp

Filesize
8.4MB

Download
memory/932-68-0x00000000777A0000-0x0000000077920000-memory.dmp

Filesize
1.5MB

Download
memory/932-57-0x0000000000000000-mapping.dmp

Download
memory/1080-54-0x00000000009D0000-0x0000000000D40000-memory.dmp

Filesize
3.4MB

Download
memory/1080-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1080-60-0x0000000005820000-0x000000000608C000-memory.dmp

Filesize
8.4MB

Download
memory/1084-69-0x0000000000000000-mapping.dmp

Download
memory/1768-70-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads