b09403adcaf79f3602815c242b3698e43138156d848ac1b0802232d4afc36154

Resubmissions

13-11-2022 18:00

22-09-2022 05:49

21-09-2022 18:45

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2022 18:00

Target

LockBit30/Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2280 wrote to memory of 2544	2280	cmd.exe	keygen.exe
PID 2280 wrote to memory of 2544	2280	cmd.exe	keygen.exe
PID 2280 wrote to memory of 2544	2280	cmd.exe	keygen.exe
PID 2280 wrote to memory of 1844	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 1844	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 1844	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 1556	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 1556	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 1556	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3972	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3972	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3972	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3400	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3400	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3400	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3256	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3256	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3256	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3728	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3728	2280	cmd.exe	builder.exe
PID 2280 wrote to memory of 3728	2280	cmd.exe	builder.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LockBit30\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280

C:\Users\Admin\AppData\Local\Temp\LockBit30\keygen.exe
keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit30\Build -pubkey pub.key -privkey priv.key
2⤵
PID:2544

C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exe
builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3Decryptor.exe
2⤵
PID:1844

C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exe
builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3.exe
2⤵
PID:1556

C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exe
builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3_pass.exe
2⤵
PID:3972

C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exe
builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3_Rundll32.dll
2⤵
PID:3400

C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exe
builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3_Rundll32_pass.dll
2⤵
PID:3256

C:\Users\Admin\AppData\Local\Temp\LockBit30\builder.exe
builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll
2⤵
PID:3728

C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\priv.key
Filesize
344B

MD5
5946bf575aeea7f2fba6050e25af3803

SHA1
28d78f48c0d00996df41f7b6326e6d7bd3b7df0c

SHA256
aaa353efc6cd20bcc25d080b4bb1d39f46193967982c0d55079c18519a3b41b3

SHA512
92c0a5dc8adbaa2af86c5662c3749292d926ad5b123e88c75db3a79a7f403e76deea326d20d228b8a226b672cd60a8b9c58e0115b0247c9bd168d94984d6d2eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\LockBit30\Build\pub.key
Filesize
344B

MD5
515c832372cebdbf67d1c6e5cd4cb0dc

SHA1
13a125d2567b70989b9f42e3125ff8846acb16f0

SHA256
abd76a3834aee7c9450786f85ff7a6e04629809a219a3a2d83bb558885157958

SHA512
fd39e61c75ba9f63e5de92621f25914798e7fb9990851d2af48ae67e9120cc0acbb1e22526936ceb004023da0438bb13f3f481e3e9bb3b30a7ec0c86cf312606

Download Submit
memory/1556-135-0x0000000000000000-mapping.dmp

Download
memory/1844-133-0x0000000000000000-mapping.dmp

Download
memory/2544-132-0x0000000000000000-mapping.dmp

Download
memory/3256-139-0x0000000000000000-mapping.dmp

Download
memory/3400-138-0x0000000000000000-mapping.dmp

Download
memory/3728-140-0x0000000000000000-mapping.dmp

Download
memory/3972-137-0x0000000000000000-mapping.dmp

Download