b2c3beda4b000a3d9af0a457d6d942ec81696f3ed485f7cf723b18008a5f3d10

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LBLeak/Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

pid	Process
2024	keygen.exe
1960	builder.exe
1872	builder.exe
2168	builder.exe
2032	builder.exe
3044	builder.exe
2796	builder.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2024	2224	cmd.exe	29
PID 2224 wrote to memory of 2024	2224	cmd.exe	29
PID 2224 wrote to memory of 2024	2224	cmd.exe	29
PID 2224 wrote to memory of 2024	2224	cmd.exe	29
PID 2224 wrote to memory of 1960	2224	cmd.exe	30
PID 2224 wrote to memory of 1960	2224	cmd.exe	30
PID 2224 wrote to memory of 1960	2224	cmd.exe	30
PID 2224 wrote to memory of 1960	2224	cmd.exe	30
PID 2224 wrote to memory of 1872	2224	cmd.exe	31
PID 2224 wrote to memory of 1872	2224	cmd.exe	31
PID 2224 wrote to memory of 1872	2224	cmd.exe	31
PID 2224 wrote to memory of 1872	2224	cmd.exe	31
PID 2224 wrote to memory of 2168	2224	cmd.exe	32
PID 2224 wrote to memory of 2168	2224	cmd.exe	32
PID 2224 wrote to memory of 2168	2224	cmd.exe	32
PID 2224 wrote to memory of 2168	2224	cmd.exe	32
PID 2224 wrote to memory of 2032	2224	cmd.exe	33
PID 2224 wrote to memory of 2032	2224	cmd.exe	33
PID 2224 wrote to memory of 2032	2224	cmd.exe	33
PID 2224 wrote to memory of 2032	2224	cmd.exe	33
PID 2224 wrote to memory of 3044	2224	cmd.exe	34
PID 2224 wrote to memory of 3044	2224	cmd.exe	34
PID 2224 wrote to memory of 3044	2224	cmd.exe	34
PID 2224 wrote to memory of 3044	2224	cmd.exe	34
PID 2224 wrote to memory of 2796	2224	cmd.exe	35
PID 2224 wrote to memory of 2796	2224	cmd.exe	35
PID 2224 wrote to memory of 2796	2224	cmd.exe	35
PID 2224 wrote to memory of 2796	2224	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LBLeak\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\LBLeak\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LBLeak\Build -pubkey pub.key -privkey priv.key
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3Decryptor.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_pass.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_Rundll32.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_Rundll32_pass.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\priv.key

Filesize
344B

MD5
35743252fc914a200d720c3eae6a7749

SHA1
6b073ab99132f9e20a2668250ad95352d4ecad67

SHA256
67f015b7fe2af756ac4dec867e9169adc8c9640f6f93a3aa3fd899075bcb09a3

SHA512
32a7985fb32c0248945a06493cf295117047143eed39bdb53a0df015b3386e100e0b87e37ffe348744ecb1b660932c943b0cca89919cf21ca6ff4a6de98b9410

Download Submit
C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key

Filesize
344B

MD5
9d519acff15a1e38016664cddbc286ae

SHA1
39f7a33d6bf9712eda6e7f807f631858d29e1493

SHA256
b8a0701a001af300e734a3fcc6256e642f8ebe3657d2fa2797137982be689481

SHA512
d5853c89a1bec23c30138d883e5763c87832d1c0b259aa5eee25d1fa5e613c8d6cf9109ebdcc51d54b70a7924290555d3687a8bd2d4fd0de7f85a9d5ea583d50

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads