lockbit | LBB[.]xxxx[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

LBB.xxxx.exe
Size

159KB
MD5

73564b24197317382ed4b526e341abce
SHA1

af028058b793c036191fd6072f194e66bb11c2c9
SHA256

e80b293b0cecb5265f2a6cc592ee11fea28c3d008fa883781aca1da3f09140b1
SHA512

2ead29b4212e4f79ce5f61f7d3bdea6c431d1c6150a943625f11d2bbe53d944450abfba7b3e4926e9c697a8f6fe5d6aad0d286daa1f305492712c323fdc07299
SSDEEP

3072:luJ9OlKolUa1U197bzhVsmftsxetGS/To84ri9CEEtmg1yXJ:lufj0zi1dNVsmftk8Gr86pE8k

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
sample	family_lockbit

Files

LBB.xxxx.exe
.exe windows x86

89b43582b27abefb2b74684ab12a2f8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

CreateDIBitmap
TextOutW
SetTextColor
SetPixel
GetTextMetricsW
GetTextColor
GetTextCharset
BitBlt

user32

CreateDialogParamW
CreateMenu
DefWindowProcW
EndDialog
GetDlgItem
GetKeyNameTextW
LoadImageW

kernel32

GetModuleHandleW
SetLastError
LoadLibraryW
LoadLibraryExA
FormatMessageW
GetLastError
GetDateFormatW
GetAtomNameW

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ