34ae59b7acc09c2e82625640cae82c5158b649db1418ddbaa24138b51f1722c5

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockBit-Black-Builder-main/LockBit30/Build.bat
Size

733B
MD5

1905cc9973206fea5050b737f9303fb4
SHA1

497524177d9478a4b5dca3e73cc230be6abf4ce0
SHA256

e2f5b93040d57de6251d16256bcd04aa8eb337bde87308e602f01070efd345fb
SHA512

95bae9406d01083f6fe6916ecf8e889afe20ff5863070f1787dc7a60d2d1d5af2cf3fd481a3c4fb531f16dd2cb7a685002aaac1dc907cf189c19c60f2816dd76

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

pid	Process
2756	keygen.exe
2648	builder.exe
2776	builder.exe
2796	builder.exe
2824	builder.exe
2708	builder.exe
2056	builder.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2756	1956	cmd.exe	29
PID 1956 wrote to memory of 2756	1956	cmd.exe	29
PID 1956 wrote to memory of 2756	1956	cmd.exe	29
PID 1956 wrote to memory of 2756	1956	cmd.exe	29
PID 1956 wrote to memory of 2648	1956	cmd.exe	30
PID 1956 wrote to memory of 2648	1956	cmd.exe	30
PID 1956 wrote to memory of 2648	1956	cmd.exe	30
PID 1956 wrote to memory of 2648	1956	cmd.exe	30
PID 1956 wrote to memory of 2776	1956	cmd.exe	31
PID 1956 wrote to memory of 2776	1956	cmd.exe	31
PID 1956 wrote to memory of 2776	1956	cmd.exe	31
PID 1956 wrote to memory of 2776	1956	cmd.exe	31
PID 1956 wrote to memory of 2796	1956	cmd.exe	32
PID 1956 wrote to memory of 2796	1956	cmd.exe	32
PID 1956 wrote to memory of 2796	1956	cmd.exe	32
PID 1956 wrote to memory of 2796	1956	cmd.exe	32
PID 1956 wrote to memory of 2824	1956	cmd.exe	33
PID 1956 wrote to memory of 2824	1956	cmd.exe	33
PID 1956 wrote to memory of 2824	1956	cmd.exe	33
PID 1956 wrote to memory of 2824	1956	cmd.exe	33
PID 1956 wrote to memory of 2708	1956	cmd.exe	34
PID 1956 wrote to memory of 2708	1956	cmd.exe	34
PID 1956 wrote to memory of 2708	1956	cmd.exe	34
PID 1956 wrote to memory of 2708	1956	cmd.exe	34
PID 1956 wrote to memory of 2056	1956	cmd.exe	35
PID 1956 wrote to memory of 2056	1956	cmd.exe	35
PID 1956 wrote to memory of 2056	1956	cmd.exe	35
PID 1956 wrote to memory of 2056	1956	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build -pubkey pub.key -privkey priv.key
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2756
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32_pass.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\priv.key

Filesize
344B

MD5
e40ce881e198d0488aa6f2971033b0c7

SHA1
56114f1292aa5ca90a28fa902349b0017adc3d58

SHA256
76089082a348cdb76baf0de817e6beb5e7180093ea05e66fbcd5d63dfb469f0f

SHA512
e7e8e11cf0a761fbb86466ea2b93a3ce49f54e436f47a7073cee348b243dd5e220ff2ffcef2bb13ff45e6a12832e6acd241f4eda4e10e2b1912749405f3e03af

Download Submit
C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key

Filesize
344B

MD5
e55b39704e90b48e908d50f939748d63

SHA1
1eeaa61c61493a6edf77312a2b1be08f3c774a09

SHA256
4287430acf8a366d49ba9c71bf224172adc4af8cac229f20f71e31f1f586fb39

SHA512
416e45206310ce41fc050e526a25108733b71b655bd25f20b426cb5b8e904be3544987321e1543e702b2431df92875f37a2855c58c2a0d0653219f243d36062a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads