lockbit | eb0ae42fecb938908ff45709af56e695a10884d73eba0a096ec6d96065b65354

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 17:30

Target

2024-02-03_addbf79fb2bfee707e237c769f3a8070_lockbit.exe
Size

155KB
MD5

addbf79fb2bfee707e237c769f3a8070
SHA1

36e6583de97089103c956954bc3de95074b6b068
SHA256

eb0ae42fecb938908ff45709af56e695a10884d73eba0a096ec6d96065b65354
SHA512

91c2a4ffea6bc71f2afce770c47155caad4720cb1707f6c683d495d2a92d2089960f2cfc6c732929ee4c90ec1385b063767b4e2dff1762319d8ce46f7324e75e
SSDEEP

3072:TRvZC0q4/O4TIeVzkN8JyFtAPdKPR1QOb6Dkl4e0Rm:TxZC/EO4T3hJyFuPqrQW6DkH

Score

10^/10

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs

resource	yara_rule
behavioral2/memory/1140-0-0x0000000000400000-0x000000000042A000-memory.dmp	family_lockbit
behavioral2/memory/1140-1-0x0000000000400000-0x000000000042A000-memory.dmp	family_lockbit

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	1140	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-03_addbf79fb2bfee707e237c769f3a8070_lockbit.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_addbf79fb2bfee707e237c769f3a8070_lockbit.exe"
1⤵
PID:1140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 264
  2⤵
  - Program crash
  PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1140 -ip 1140
1⤵
PID:2072

memory/1140-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1140-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download