Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2022 11:22
Behavioral task
behavioral1
Sample
LockBit30/Build.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
LockBit30/Build.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
LockBit30/builder.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
LockBit30/builder.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
LockBit30/keygen.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
LockBit30/keygen.exe
Resource
win10v2004-20220812-en
General
-
Target
LockBit30/Build.bat
-
Size
741B
-
MD5
4e46e28b2e61643f6af70a8b19e5cb1f
-
SHA1
804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
-
SHA256
8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
-
SHA512
009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1048 wrote to memory of 544 1048 cmd.exe 78 PID 1048 wrote to memory of 544 1048 cmd.exe 78 PID 1048 wrote to memory of 544 1048 cmd.exe 78 PID 1048 wrote to memory of 2880 1048 cmd.exe 79 PID 1048 wrote to memory of 2880 1048 cmd.exe 79 PID 1048 wrote to memory of 2880 1048 cmd.exe 79 PID 1048 wrote to memory of 3544 1048 cmd.exe 80 PID 1048 wrote to memory of 3544 1048 cmd.exe 80 PID 1048 wrote to memory of 3544 1048 cmd.exe 80 PID 1048 wrote to memory of 3700 1048 cmd.exe 81 PID 1048 wrote to memory of 3700 1048 cmd.exe 81 PID 1048 wrote to memory of 3700 1048 cmd.exe 81 PID 1048 wrote to memory of 2396 1048 cmd.exe 82 PID 1048 wrote to memory of 2396 1048 cmd.exe 82 PID 1048 wrote to memory of 2396 1048 cmd.exe 82 PID 1048 wrote to memory of 928 1048 cmd.exe 83 PID 1048 wrote to memory of 928 1048 cmd.exe 83 PID 1048 wrote to memory of 928 1048 cmd.exe 83 PID 1048 wrote to memory of 1192 1048 cmd.exe 84 PID 1048 wrote to memory of 1192 1048 cmd.exe 84 PID 1048 wrote to memory of 1192 1048 cmd.exe 84
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LockBit30\Build.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\LockBit30\keygen.exekeygen -path C:\Users\Admin\AppData\Local\Temp\LockBit30\Build -pubkey pub.key -privkey priv.key2⤵PID:544
-
-
C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exebuilder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3Decryptor.exe2⤵PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exebuilder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3.exe2⤵PID:3544
-
-
C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exebuilder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3_pass.exe2⤵PID:3700
-
-
C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exebuilder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3_Rundll32.dll2⤵PID:2396
-
-
C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exebuilder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3_Rundll32_pass.dll2⤵PID:928
-
-
C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exebuilder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll2⤵PID:1192
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD5541840b9aa47d7ef280341dfc8b2b198
SHA185e00aceba01b8c228077d97a0caf609164f7e12
SHA256e2b26a978fff7d59e087e349d5a6ddbd876836e330df8e7c37712b8b61089f8e
SHA512d1be3dc2cdf0dfdd8eda00d3fcd08fae4c73b93e92c59076d4cc8202a75bca44d813aa14064f49beb4b97d08d379097bdf3cfa132d50ab7524dbd23ea9be9919
-
Filesize
344B
MD5873c164483e5d8940b729ac007d74608
SHA1b990d25092038d6c9ec61e0e52b26f4c5b2d6e3a
SHA256c9de6238ba7eee2486ff6eee3fc860be669b6dba5297bf4a3fc368f020967013
SHA51266897fd2f1cd97bdfab39c7b4c3e35fb4fd845bd2a824660d4a90f0a3f430465266fc25e4f1233b72f8c88246eb1c326806aeeedabee2c0afa6babbd046fb857