Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 04:06
Static task
static1
Behavioral task
behavioral1
Sample
10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll
Resource
win10v2004-20240226-en
General
-
Target
10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll
-
Size
103KB
-
MD5
e9f6513c37debcce50e9633aefa757c0
-
SHA1
e7623d6cb0cf234b9f3e3f8b14f63e2077441a0f
-
SHA256
10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd
-
SHA512
de6d502b6bb6d6b46d5b0170db2e3f22f376f5370b6fe6793efbe3ea2207e65033d0b3e0b195b90833ec305bd0decffb6264f2dc973160dbdc330646af242d74
-
SSDEEP
1536:QzICS4A30TY1kUS/U2ztdS1I6DdL9Ta1lx1411ey2NzPBmdy6h+/:vJ0TYyUS/U2RgGWL9+zx1c1eXNNmdA/
Malware Config
Extracted
C:\Users\wkyNXZoXP.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt.uz
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes itself 1 IoCs
Processes:
DCE7.tmppid process 1644 DCE7.tmp -
Executes dropped EXE 1 IoCs
Processes:
DCE7.tmppid process 1644 DCE7.tmp -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2192 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
DCE7.tmppid process 1644 DCE7.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wkyNXZoXP rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wkyNXZoXP\ = "wkyNXZoXP" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wkyNXZoXP\DefaultIcon rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wkyNXZoXP rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wkyNXZoXP\DefaultIcon\ = "C:\\ProgramData\\wkyNXZoXP.ico" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
rundll32.exepid process 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
DCE7.tmppid process 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp 1644 DCE7.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
rundll32.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeDebugPrivilege 2192 rundll32.exe Token: 36 2192 rundll32.exe Token: SeImpersonatePrivilege 2192 rundll32.exe Token: SeIncBasePriorityPrivilege 2192 rundll32.exe Token: SeIncreaseQuotaPrivilege 2192 rundll32.exe Token: 33 2192 rundll32.exe Token: SeManageVolumePrivilege 2192 rundll32.exe Token: SeProfSingleProcessPrivilege 2192 rundll32.exe Token: SeRestorePrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSystemProfilePrivilege 2192 rundll32.exe Token: SeTakeOwnershipPrivilege 2192 rundll32.exe Token: SeShutdownPrivilege 2192 rundll32.exe Token: SeDebugPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeDebugPrivilege 2192 rundll32.exe Token: 36 2192 rundll32.exe Token: SeImpersonatePrivilege 2192 rundll32.exe Token: SeIncBasePriorityPrivilege 2192 rundll32.exe Token: SeIncreaseQuotaPrivilege 2192 rundll32.exe Token: 33 2192 rundll32.exe Token: SeManageVolumePrivilege 2192 rundll32.exe Token: SeProfSingleProcessPrivilege 2192 rundll32.exe Token: SeRestorePrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSystemProfilePrivilege 2192 rundll32.exe Token: SeTakeOwnershipPrivilege 2192 rundll32.exe Token: SeShutdownPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeSecurityPrivilege 2192 rundll32.exe Token: SeBackupPrivilege 2192 rundll32.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exeDCE7.tmpdescription pid process target process PID 2012 wrote to memory of 2192 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2192 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2192 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2192 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2192 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2192 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2192 2012 rundll32.exe rundll32.exe PID 2192 wrote to memory of 1644 2192 rundll32.exe DCE7.tmp PID 2192 wrote to memory of 1644 2192 rundll32.exe DCE7.tmp PID 2192 wrote to memory of 1644 2192 rundll32.exe DCE7.tmp PID 2192 wrote to memory of 1644 2192 rundll32.exe DCE7.tmp PID 2192 wrote to memory of 1644 2192 rundll32.exe DCE7.tmp PID 1644 wrote to memory of 2016 1644 DCE7.tmp cmd.exe PID 1644 wrote to memory of 2016 1644 DCE7.tmp cmd.exe PID 1644 wrote to memory of 2016 1644 DCE7.tmp cmd.exe PID 1644 wrote to memory of 2016 1644 DCE7.tmp cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll,#12⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\ProgramData\DCE7.tmp"C:\ProgramData\DCE7.tmp"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DCE7.tmp >> NUL4⤵PID:2016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize103KB
MD5f495d9dde5d0becabfe1c30277e4f0b4
SHA1a3468d9df3c983c8fc7b45c2d41a53bf87aa0aac
SHA256e0046d878e665decf7b0e613ab5b0cd506855ca07510cd0c6359e285173ed154
SHA512829f54686543ccb5f2719b2b7e9afa2e18cf482837cc1d2ada221edbc787cce27f1a2c8c4887fac6322d7346de3857eb6067b5293dffb24a293c3f7bb206da13
-
Filesize
3KB
MD5fad0a90c05731e681986c655bf629669
SHA1c262ebf63d90024d4a930e94d07bec1488843718
SHA25652101729b68cab0bee0bfe63ba4a513fe61dd5f4974b057a2a2629a77c2e8a45
SHA5121c9e454889f1fad1f524eee912f4a4c98f4c6ceb73f2b78aad5cbc908d507db225c854d955a406b3616e4ff65efa1eb5c8c009f400203421fb2db239f36cd395
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf