d1b5c11b4e2fa35dca4221ef9b8e097b987c159fd52a9eae88fd96d54f78d5ed

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2022 18:15

Target

LockBit3Builder/Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 944 wrote to memory of 2432	944	cmd.exe	keygen.exe
PID 944 wrote to memory of 2432	944	cmd.exe	keygen.exe
PID 944 wrote to memory of 2432	944	cmd.exe	keygen.exe
PID 944 wrote to memory of 3104	944	cmd.exe	builder.exe
PID 944 wrote to memory of 3104	944	cmd.exe	builder.exe
PID 944 wrote to memory of 3104	944	cmd.exe	builder.exe
PID 944 wrote to memory of 312	944	cmd.exe	builder.exe
PID 944 wrote to memory of 312	944	cmd.exe	builder.exe
PID 944 wrote to memory of 312	944	cmd.exe	builder.exe
PID 944 wrote to memory of 1120	944	cmd.exe	builder.exe
PID 944 wrote to memory of 1120	944	cmd.exe	builder.exe
PID 944 wrote to memory of 1120	944	cmd.exe	builder.exe
PID 944 wrote to memory of 808	944	cmd.exe	builder.exe
PID 944 wrote to memory of 808	944	cmd.exe	builder.exe
PID 944 wrote to memory of 808	944	cmd.exe	builder.exe
PID 944 wrote to memory of 4872	944	cmd.exe	builder.exe
PID 944 wrote to memory of 4872	944	cmd.exe	builder.exe
PID 944 wrote to memory of 4872	944	cmd.exe	builder.exe
PID 944 wrote to memory of 4796	944	cmd.exe	builder.exe
PID 944 wrote to memory of 4796	944	cmd.exe	builder.exe
PID 944 wrote to memory of 4796	944	cmd.exe	builder.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build -pubkey pub.key -privkey priv.key
2⤵
PID:2432

C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\LB3Decryptor.exe
2⤵
PID:3104

C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\LB3.exe
2⤵
PID:312

C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\LB3_pass.exe
2⤵
PID:1120

C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\LB3_Rundll32.dll
2⤵
PID:808

C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\LB3_Rundll32_pass.dll
2⤵
PID:4872

C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\LB3_ReflectiveDll_DllMain.dll
2⤵
PID:4796

C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\priv.key
Filesize
344B

MD5
06fd3a245bc08eea753e9a6e711af053

SHA1
42ff545e7658a180fbb0122972c10d598294ea3f

SHA256
ed8f4ee19d622c6373435215686c16af5eb2e701c3c07937c376ce53bbe8b70a

SHA512
19b37634dddd1538785896cd6029a7663232fdbbea41cf0e1c0b68fafa02be2581f04d9367a89a030ca5eb0a0010339d490d7a533ad5c4931c55cf04342d1074

Download Submit
C:\Users\Admin\AppData\Local\Temp\LockBit3Builder\Build\pub.key
Filesize
344B

MD5
c23ca1eb4a5281c577821d96b30d4b92

SHA1
8f6b93371163f8f53559f778e7b983c88ef01c1b

SHA256
b13543724b6cea33cf4b68488335521c7d8375fb11ed048a3857f66516324049

SHA512
ec3e70975d22b49c98942f354097a489616ae3cf519f2d8cd74ba8593467970e877717d5e5fd974c84858f78b00cb9027714419eeae67dfc1168a8731b806ebe

Download Submit
memory/312-135-0x0000000000000000-mapping.dmp

Download
memory/808-138-0x0000000000000000-mapping.dmp

Download
memory/1120-137-0x0000000000000000-mapping.dmp

Download
memory/2432-132-0x0000000000000000-mapping.dmp

Download
memory/3104-133-0x0000000000000000-mapping.dmp

Download
memory/4796-140-0x0000000000000000-mapping.dmp

Download
memory/4872-139-0x0000000000000000-mapping.dmp

Download