Behavioral task
behavioral1
Sample
2024-01-11_7cbb03611ca7bbbd2525291041e55763_darkside_lockbit.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-11_7cbb03611ca7bbbd2525291041e55763_darkside_lockbit.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-11_7cbb03611ca7bbbd2525291041e55763_darkside_lockbit
-
Size
469KB
-
MD5
7cbb03611ca7bbbd2525291041e55763
-
SHA1
68c8370df6392c2a26499bc3c2a0139fe0b39f6f
-
SHA256
6a3abbf02ac8e742aee4381d14cfc0da3969e8c6ce1f22fc9922ad1fed8c080e
-
SHA512
4534eae23f3a6f4f21aad0b0a3fe286dba7e579b1ff871f520bec2f31a3d894c890971266dbd854c4aa82dceb6b45e68fd6edf4487186b063382ea299f97b558
-
SSDEEP
12288:SjBXpdRigM0d4vzFRfaoN1hG98P67PNV3giFH6J1VjR3L6dpbQrQyEpInmwueUfE:Sj9jRlQpBN1hG98P67PNV3giFH6J1VjN
Malware Config
Signatures
-
Blackmatter family
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule sample family_lockbit -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-11_7cbb03611ca7bbbd2525291041e55763_darkside_lockbit
Files
-
2024-01-11_7cbb03611ca7bbbd2525291041e55763_darkside_lockbit.exe windows:5 windows x86 arch:x86
d2e26e45dcb84f1062f90f29a9cf0faa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxW
kernel32
LoadResource
WriteFile
CreateFileW
ExitProcess
FindResourceW
GetCommandLineW
GetFileSize
GetModuleHandleW
GlobalFree
SizeofResource
LockResource
ReadFile
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
sprintf
strchr
strcpy
strlen
strstr
wcscat
wcscpy
wcslen
wcsrchr
localeconv
_stricmp
_strcmpi
tolower
realloc
malloc
free
strtod
strncmp
imagehlp
CheckSumMappedFile
ntdll
RtlFreeHeap
RtlAllocateHeap
NtClose
RtlImageNtHeader
Sections
.yRoj9 Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VswD Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.8h6HO6 Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Tm2KvGE Size: 438KB - Virtual size: 438KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ