707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 19:06

Target

LockBit-main/Build.bat
Size

1KB
MD5

b8f24efd1d30aac9d360db90c8717aee
SHA1

7d31372560f81ea24db57bb18d56143251a8b266
SHA256

95df1d82137315708931f1fc3411e891cd42d1cab413d4380b479788729248ed
SHA512

14ebf7905f15983593164d1c093bb99d098daf3963f1b7a913c1a9763acb950075a0d2cceab3558cce3e7269c2a2d5dacc2b3c6c55807b0b6bda6bfad62dd032

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 4448	1796	cmd.exe	96
PID 1796 wrote to memory of 4448	1796	cmd.exe	96
PID 1796 wrote to memory of 4448	1796	cmd.exe	96
PID 1796 wrote to memory of 1736	1796	cmd.exe	97
PID 1796 wrote to memory of 1736	1796	cmd.exe	97
PID 1796 wrote to memory of 1736	1796	cmd.exe	97
PID 1796 wrote to memory of 400	1796	cmd.exe	98
PID 1796 wrote to memory of 400	1796	cmd.exe	98
PID 1796 wrote to memory of 400	1796	cmd.exe	98
PID 1796 wrote to memory of 2920	1796	cmd.exe	99
PID 1796 wrote to memory of 2920	1796	cmd.exe	99
PID 1796 wrote to memory of 2920	1796	cmd.exe	99
PID 1796 wrote to memory of 4100	1796	cmd.exe	100
PID 1796 wrote to memory of 4100	1796	cmd.exe	100
PID 1796 wrote to memory of 4100	1796	cmd.exe	100
PID 1796 wrote to memory of 4104	1796	cmd.exe	101
PID 1796 wrote to memory of 4104	1796	cmd.exe	101
PID 1796 wrote to memory of 4104	1796	cmd.exe	101
PID 1796 wrote to memory of 1352	1796	cmd.exe	102
PID 1796 wrote to memory of 1352	1796	cmd.exe	102
PID 1796 wrote to memory of 1352	1796	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LockBit-main\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\LockBit-main\keygen.exe
  keygen -path Build -pubkey pub.key -privkey priv.key
  2⤵
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\LockBit-main\builder.exe
  builder -type dec -privkey Build\priv.key -config config.json -ofile Build\LB3Decryptor.exe
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\LockBit-main\builder.exe
  builder -type enc -exe -pubkey Build\pub.key -config config.json -ofile Build\LB3.exe
  2⤵
  PID:400
- C:\Users\Admin\AppData\Local\Temp\LockBit-main\builder.exe
  builder -type enc -exe -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_pass.exe
  2⤵
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\LockBit-main\builder.exe
  builder -type enc -dll -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32.dll
  2⤵
  PID:4100
- C:\Users\Admin\AppData\Local\Temp\LockBit-main\builder.exe
  builder -type enc -dll -pass -pubkey Build\pub.key -config config.json -ofile Build\LB3_Rundll32_pass.dll
  2⤵
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\LockBit-main\builder.exe
  builder -type enc -ref -pubkey Build\pub.key -config config.json -ofile Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  PID:1352

C:\Users\Admin\AppData\Local\Temp\LockBit-main\Build\priv.key

Filesize
344B

MD5
d6d650ba1230994bd8fbad47b842e745

SHA1
c74de09bdd7fa51a1bc1232e14f0a37c00463e2e

SHA256
4146a2c8ff7e4ddd45f8367cf3ebd3e7ee74eae29d8937b7aaa7444a01f04ac2

SHA512
0c13a5343fed265be1d8e0e0c30272b81a716318b906281ab3aaaf48fe75adc69c4bb932324ddc19828126ac982c65a66969ae4ba7a17f3f53841ab895e3aafd

Download Submit
C:\Users\Admin\AppData\Local\Temp\LockBit-main\Build\pub.key

Filesize
344B

MD5
eb2c80b821b3a858b72058e9a97ccb5b

SHA1
4cc2c5a90da484ae8e88ee6ddce56eb24a9e77b5

SHA256
cbbd28856587ce405e2b3ac1a3b0e077bc749d4927f60db2dbb78669b24f1644

SHA512
a6a0ed975c16a63efa34c75678d784d3deffc44c2bb9e82a69cc4b4e409152e67cf893dc9c392458c7bc94deca1ebfe02600edab2d4aa2e01e182bd2d1005b8b

Download Submit