Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07/03/2023, 04:54
Behavioral task
behavioral1
Sample
bOpDX.bin.exe
Resource
win7-20230220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bOpDX.bin.exe
Resource
win10v2004-20230220-en
3 signatures
150 seconds
General
-
Target
bOpDX.bin.exe
-
Size
142KB
-
MD5
4b122da82c589d68d15a98ba73997910
-
SHA1
3e4e31479d739e49af21f381a2be11a4e93d2d22
-
SHA256
cc58dcd32a440e7f95d19b653a55c1e2c383efc2bd19443238dd3008c1cbe147
-
SHA512
9215fe45b9714916a317abc8715778ad56f8c9cf461b4493a6e66bb10f441f924747af3ab7f80d5c4d2bc6207ac8af31ed529044ced4c5aaecb4975e6211bc22
-
SSDEEP
3072:5sNRFsG/loOgX68qIAdVcxiUmL+mpSjUMYChsf4Vtr+:+NdNoOgXBqIAdGK+mpSjhn+
Score
10/10
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule behavioral1/memory/1232-54-0x0000000000400000-0x0000000000427000-memory.dmp family_lockbit -
Program crash 1 IoCs
pid pid_target Process procid_target 2004 1232 WerFault.exe 20 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1232 wrote to memory of 2004 1232 bOpDX.bin.exe 28 PID 1232 wrote to memory of 2004 1232 bOpDX.bin.exe 28 PID 1232 wrote to memory of 2004 1232 bOpDX.bin.exe 28 PID 1232 wrote to memory of 2004 1232 bOpDX.bin.exe 28