34ae59b7acc09c2e82625640cae82c5158b649db1418ddbaa24138b51f1722c5

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockBit-Black-Builder-main/LockBit30/Build.bat
Size

733B
MD5

1905cc9973206fea5050b737f9303fb4
SHA1

497524177d9478a4b5dca3e73cc230be6abf4ce0
SHA256

e2f5b93040d57de6251d16256bcd04aa8eb337bde87308e602f01070efd345fb
SHA512

95bae9406d01083f6fe6916ecf8e889afe20ff5863070f1787dc7a60d2d1d5af2cf3fd481a3c4fb531f16dd2cb7a685002aaac1dc907cf189c19c60f2816dd76

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 756	3268	cmd.exe	31
PID 3268 wrote to memory of 756	3268	cmd.exe	31
PID 3268 wrote to memory of 756	3268	cmd.exe	31
PID 3268 wrote to memory of 3380	3268	cmd.exe	91
PID 3268 wrote to memory of 3380	3268	cmd.exe	91
PID 3268 wrote to memory of 3380	3268	cmd.exe	91
PID 3268 wrote to memory of 856	3268	cmd.exe	92
PID 3268 wrote to memory of 856	3268	cmd.exe	92
PID 3268 wrote to memory of 856	3268	cmd.exe	92
PID 3268 wrote to memory of 4980	3268	cmd.exe	93
PID 3268 wrote to memory of 4980	3268	cmd.exe	93
PID 3268 wrote to memory of 4980	3268	cmd.exe	93
PID 3268 wrote to memory of 3356	3268	cmd.exe	96
PID 3268 wrote to memory of 3356	3268	cmd.exe	96
PID 3268 wrote to memory of 3356	3268	cmd.exe	96
PID 3268 wrote to memory of 2696	3268	cmd.exe	94
PID 3268 wrote to memory of 2696	3268	cmd.exe	94
PID 3268 wrote to memory of 2696	3268	cmd.exe	94
PID 3268 wrote to memory of 4268	3268	cmd.exe	95
PID 3268 wrote to memory of 4268	3268	cmd.exe	95
PID 3268 wrote to memory of 4268	3268	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build -pubkey pub.key -privkey priv.key
  2⤵
  PID:756
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe
  2⤵
  PID:856
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe
  2⤵
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32_pass.dll
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32.dll
  2⤵
  PID:3356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\priv.key

Filesize
344B

MD5
405fdf15f518bfee820f8eca79da3880

SHA1
aa8871ac9e2fb7f76d9a80b3b2c6c20acc118369

SHA256
826d64d794e7416ac2223251ec5341b7988d79c05caa9e24e211c754b22cc0cd

SHA512
9f1bf25f9a39c8c80679c7d3c0efb3acd99e3c49c88d2b9a33f72ab39006e387a519b595e856d1b828fdbe21eaf230c19092bf9491044325448e275d58e89098

Download Submit
C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key

Filesize
344B

MD5
955ff0456d9214dfac9ff14be2000f29

SHA1
245e276a9ffc85e752fb37e894564516d059d508

SHA256
d92a293679daacfe8607f2f3d101209e32c11b09b123b456ffdd577b52a404a1

SHA512
2620473a78b7ab6ceb6cc30cbf83a2e47796fec9ec43e6fb782358e7c6b3c6aea27ee4e899a469fd4db4be2f1b52d60fef9a6cc5198badbca6d842c69bdb60fc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads