lockbit | 3bbba6dd904ef7a167d62bbc0eb869c5d5de595c903f62b0565c579fbbd6579d

Analysis

max time kernel
103s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 05:50

Target

3bbba6dd904ef7a167d62bbc0eb869c5d5de595c903f62b0565c579fbbd6579d.exe
Size

142KB
MD5

8d110f8577a78a22c9fefdf1539df463
SHA1

67e6787249929e159894e459f15a125215dc0828
SHA256

3bbba6dd904ef7a167d62bbc0eb869c5d5de595c903f62b0565c579fbbd6579d
SHA512

29bc1b50e443f1f88a283b92421371acece06b2fdcea095834694867c3f4ac9e5c967237971ff1537507b3fd390a1101048c6ed3122e5dc46d931295ba8eab97
SSDEEP

3072:EixLzZlXRu85KiqKnTj/Hr5mn0XwD5dmDccEH8Vb4WcYVhZpdNL:EixLzj48IKnTbrU+rDc7H8Vx1VhNNL

Score

10^/10

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1540-133-0x0000000000400000-0x0000000000427000-memory.dmp	family_lockbit

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1564 1540 WerFault.exe 3bbba6dd904ef7a167d62bbc0eb869c5d5de595c903f62b0565c579fbbd6579d.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

4364 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

4364 vlc.exe
Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

vlc.exe

pid process

4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
Suspicious use of SendNotifyMessage 11 IoCs

Processes:

vlc.exe

pid process

4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
4364 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

4364 vlc.exe

pid	pid_target	process	target process
1564	1540	WerFault.exe	3bbba6dd904ef7a167d62bbc0eb869c5d5de595c903f62b0565c579fbbd6579d.exe

pid	process
4364	vlc.exe

pid	process
4364	vlc.exe

pid	process
4364	vlc.exe

C:\Users\Admin\AppData\Local\Temp\3bbba6dd904ef7a167d62bbc0eb869c5d5de595c903f62b0565c579fbbd6579d.exe
"C:\Users\Admin\AppData\Local\Temp\3bbba6dd904ef7a167d62bbc0eb869c5d5de595c903f62b0565c579fbbd6579d.exe"
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 252
2⤵
- Program crash
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1540 -ip 1540
1⤵
PID:2232

memory/1540-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4364-147-0x00007FF63F530000-0x00007FF63F628000-memory.dmp

Filesize
992KB

Download
memory/4364-148-0x00007FF8F0700000-0x00007FF8F0734000-memory.dmp

Filesize
208KB

Download
memory/4364-149-0x00007FF8EFE70000-0x00007FF8F0124000-memory.dmp

Filesize
2.7MB

Download
memory/4364-150-0x00007FF8EEBC0000-0x00007FF8EFC6B000-memory.dmp

Filesize
16.7MB

Download
memory/4364-151-0x00007FF8EE010000-0x00007FF8EE122000-memory.dmp

Filesize
1.1MB

Download