lockbit | 514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c

Analysis

max time kernel
34s
max time network
19s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:21

Target

514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c.exe
Size

142KB
MD5

867c25ae2826d709dc4b32ed23e2f0dd
SHA1

8cd86a05a5bd9970e1b4579a1fb855d102785636
SHA256

514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c
SHA512

1f872fe985c1bc60078f517b4760bf971328e39eac58e2d7c5bdff6d7bf8f57676d443ee0bd4c0956e3ae4e9b54f6f1eb5110980d484f49a39b7c23da373bebd
SSDEEP

3072:FdXFgAWq0ra8B1U0Oafc2Js/SK86VfdR4djWc:Fd1gAhIa+C0OZ2JRKZV18v

Score

10^/10

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
behavioral1/memory/2688-0-0x0000000000400000-0x0000000000427000-memory.dmp	family_lockbit

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	2688	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2856	2688	514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c.exe	29
PID 2688 wrote to memory of 2856	2688	514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c.exe	29
PID 2688 wrote to memory of 2856	2688	514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c.exe	29
PID 2688 wrote to memory of 2856	2688	514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c.exe	29

C:\Users\Admin\AppData\Local\Temp\514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c.exe
"C:\Users\Admin\AppData\Local\Temp\514ab21709f4e2867b4b79008e37aed7ce501a78785369adb6e31bb90156030c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 88
  2⤵
  - Program crash
  PID:2856

memory/2688-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download