lockbit | 34ae59b7acc09c2e82625640cae82c5158b649db1418ddbaa24138b51f1722c5

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 16:14

Target

LockBit-Black-Builder-main/LockBit30/Build/LB3_Rundll32_pass.dll
Size

148KB
MD5

1cf36fecacae95acaed46247090fd4b6
SHA1

4dcf048521b7c8fcba54d20f06be6ea60131bce1
SHA256

6eb4d985a52554d37c0efec1457258e4dfd4619ff0396c66e2f9a02d8381ce57
SHA512

7b6c660245ed236a12e4c7e36e30283b5d2736de2d419da60d4ab584016de24dd40f7c4d407c5a4cee3c1995d136a775f72ed2ca16c911d75a2c9c2f4b57a99c
SSDEEP

3072:TTmYfHnIUoQ3+Cv9y5esf+Ieva3YVxz8jZGhjhjGI:TBvn3+WnSev7VujMzf

Score

10^/10

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
behavioral11/memory/2320-1-0x0000000010000000-0x0000000010029000-memory.dmp	family_lockbit

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2320	2676	rundll32.exe	28
PID 2676 wrote to memory of 2320	2676	rundll32.exe	28
PID 2676 wrote to memory of 2320	2676	rundll32.exe	28
PID 2676 wrote to memory of 2320	2676	rundll32.exe	28
PID 2676 wrote to memory of 2320	2676	rundll32.exe	28
PID 2676 wrote to memory of 2320	2676	rundll32.exe	28
PID 2676 wrote to memory of 2320	2676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32_pass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32_pass.dll,#1
  2⤵
  PID:2320

memory/2320-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/2320-1-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download