Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
27-01-2024 16:14
General
-
Target
LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
-
Size
153KB
-
MD5
c73eac0c837c3c5caca3a885f46c17d9
-
SHA1
a0ca9511b40c9c2451986ce179016ec4014e9adb
-
SHA256
e609bf8406b61613f3e605d277cf445059974a4c71c3edd09fffae86a3c5dbfe
-
SHA512
157c92e561cd18876ab60faf8a3d8e62633e7750accb965e86f3202b0d5ff902d3ae51fb41592d9be22672e67a713291e469a09be57e6f77dd6343090324792a
-
SSDEEP
3072:xqJogYkcSNm9V7D2YRLCm8ZdqVAxrMismEm8T:xq2kc4m9tDlhLqb
Malware Config
Extracted
C:\ZImkTWSLZ.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (565) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\856D.tmp"C:\ProgramData\856D.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\856D.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{88A7535F-82E6-426B-97B9-52B35F27268E}.xps" 1335084571648000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD57caa2bb9c536ec9e900463676e0781c7
SHA14e358df51895d1f58a332bc28bbf9972e5adf4cb
SHA2563713cb328ab9667a5c048b42de811de0dfcba8f9fc03c10103d0a276eeb2450c
SHA512ce9a2492bd0dc5499617501a8703dcb1a6f9894a0417b094a3228be79243cce28371c4e72379e802a67507102ab80884df3d80c72daf3bc03f30f19551be1c7d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD51c3d5449ccc3eed2fc7307a0d97fd431
SHA1e7ed8697d511168139ce45dfc9f23478ed767ce9
SHA25657a5718191d14c1e64979b749d29315f2e20ae7723800a70e50ac4ad2f593004
SHA5125aa0ac32269dc6d87f074d77e1ff7f1d61cb9a1a912f9392cbe4cb72262e591e44c375f9878fae0e28394eab228cf85c347a5617138edb78c8f6849cdf9d8445
-
Filesize
4KB
MD586afd9d6382bf61b45bdd992cf22fd10
SHA18a9c11510084c183a61ba6e74365d59cf85dcc26
SHA256ce1d865a6b70d297582fb1df9bb46ae0e5ae9d265ca9f69be636d87ea12c4fff
SHA5122a04ea1b2428f6af782c4e945d68f92cdda59567547e75273b11baa3986c2072ec0a8f518e18464919da96b16679559c3ab60df6a16d9e1c35f71cfb135e4ac0
-
Filesize
4KB
MD5af2c5086c161c411fb8b1192f59e225a
SHA12321c91024829c32fc068a113556318e6653a139
SHA256b15dece3f9cdbb86785d1c3fa13fffe027865a7136599dc4d0e1d50d323aa153
SHA512e01ee0b9a8d3a4fd9faa4654fc39860cb67e2cda53f6c45643aeaa27586ef3706f8b0805fcb9ab20460678f434ae775e2e37155f9f8a62f006a2de072cb75630
-
Filesize
6KB
MD5efeea85aa4e4c7756c628fcc4df028fd
SHA1e259a0511fa5b7202943623edee8a7c936c7b086
SHA256a8e710f63a261b2b43e1a67a7584ee36699e9ef0161147d067e1bb72a17207a0
SHA5129584b6e65a5f38c3e375f9241efa0b29e2b1f345d90b556c697b3ed8200e43549912dcc247da56eb4bffa3f842eadf830878c98180965526b49d4767cdde9e05
-
Filesize
129B
MD56419ea4b699e6dffef7beb6135cb77ef
SHA1a45ce0e4399a04f7c1545514e760ba5fdbfbcee2
SHA256f38100c0b95d06b5cc1e2344bd4501a058ebba3ff358290143aa97ed5a0b7ae5
SHA512858dec8acf8240fdbfc03e52d1665c995c2c6194f4fdb4d8c582db5de07d7da8253a705417ebcf3dc238e6b83a562ee42820dfa0957bab7e4a3e880d78bc1aeb
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB