Overview
overview
8Static
static
1LBOTS_V2_F...IN.zip
windows10-1703-x64
1LBOTS V2 F...ice.js
windows10-1703-x64
8LBOTS V2 F...PC.dll
windows10-1703-x64
1LBOTS V2 F...rs.ini
windows10-1703-x64
1LBOTS V2 F...s.json
windows10-1703-x64
3LBOTS V2 F...ts.exe
windows10-1703-x64
1LBOTS V2 F...ts.exe
windows10-1703-x64
1LBOTS V2 F...ts.pdb
windows10-1703-x64
3LBOTS V2 F...v.json
windows10-1703-x64
3LBOTS V2 F...g.json
windows10-1703-x64
3LBOTS V2 F...on.dll
windows10-1703-x64
1LBOTS V2 F...rs.dll
windows10-1703-x64
1LBOTS V2 F...re.dll
windows10-1703-x64
1LBOTS V2 F...re.pdb
windows10-1703-x64
3LBOTS V2 F...ha.dll
windows10-1703-x64
1LBOTS V2 F...ts.txt
windows10-1703-x64
1LBOTS V2 F...e.json
windows10-1703-x64
3LBOTS V2 F...rp.dll
windows10-1703-x64
1Analysis
-
max time kernel
369s -
max time network
432s -
platform
windows10-1703_x64 -
resource
win10-20230220-es -
resource tags
arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
11-04-2023 14:15
Static task
static1
Behavioral task
behavioral1
Sample
LBOTS_V2_FREE_LOGIN.zip
Resource
win10-20230220-es
Behavioral task
behavioral2
Sample
LBOTS V2 FREE LOGIN/Captcha_Service.js
Resource
win10-20230220-es
Behavioral task
behavioral3
Sample
LBOTS V2 FREE LOGIN/DiscordRPC.dll
Resource
win10-20230220-es
Behavioral task
behavioral4
Sample
LBOTS V2 FREE LOGIN/Headers.ini
Resource
win10-20230220-es
Behavioral task
behavioral5
Sample
LBOTS V2 FREE LOGIN/LBots.deps.json
Resource
win10-20230220-es
Behavioral task
behavioral6
Sample
LBOTS V2 FREE LOGIN/LBots.exe
Resource
win10-20230220-es
Behavioral task
behavioral7
Sample
LBOTS V2 FREE LOGIN/LBots.exe
Resource
win10-20230220-es
Behavioral task
behavioral8
Sample
LBOTS V2 FREE LOGIN/LBots.pdb
Resource
win10-20230220-es
Behavioral task
behavioral9
Sample
LBOTS V2 FREE LOGIN/LBots.runtimeconfig.dev.json
Resource
win10-20230220-es
Behavioral task
behavioral10
Sample
LBOTS V2 FREE LOGIN/LBots.runtimeconfig.json
Resource
win10-20230220-es
Behavioral task
behavioral11
Sample
LBOTS V2 FREE LOGIN/Newtonsoft.Json.dll
Resource
win10-20230220-es
Behavioral task
behavioral12
Sample
LBOTS V2 FREE LOGIN/Sulakore.Generators.dll
Resource
win10-20230220-es
Behavioral task
behavioral13
Sample
LBOTS V2 FREE LOGIN/Sulakore.dll
Resource
win10-20230220-es
Behavioral task
behavioral14
Sample
LBOTS V2 FREE LOGIN/Sulakore.pdb
Resource
win10-20230220-es
Behavioral task
behavioral15
Sample
LBOTS V2 FREE LOGIN/TwoCaptcha.dll
Resource
win10-20230220-es
Behavioral task
behavioral16
Sample
LBOTS V2 FREE LOGIN/accounts.txt
Resource
win10-20230220-es
Behavioral task
behavioral17
Sample
LBOTS V2 FREE LOGIN/cache.json
Resource
win10-20230220-es
Behavioral task
behavioral18
Sample
LBOTS V2 FREE LOGIN/websocket-sharp.dll
Resource
win10-20230220-es
General
-
Target
LBOTS V2 FREE LOGIN/LBots.deps.json
-
Size
2KB
-
MD5
56c16886636a7c91b294adaa9d021917
-
SHA1
e44d546170c9ef90a31adb632d807d2c65c9921c
-
SHA256
3485b832f38596b38d6ecd5d001ecda90214ce0936da2dd145ed32f1f901047d
-
SHA512
0876ef6dc34c6efe0980132b45be7c8f723513911537ab35624141ce570daa0fcaba2cd3b6edb34047b339401b467a6106fc739f7a4d10f3e726625a4c086996
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1712 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\LBOTS V2 FREE LOGIN\LBots.deps.json"1⤵
- Modifies registry class
PID:1680
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1712