Analysis

  • max time kernel
    118s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-03-2024 04:06

General

  • Target

    10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll

  • Size

    103KB

  • MD5

    e9f6513c37debcce50e9633aefa757c0

  • SHA1

    e7623d6cb0cf234b9f3e3f8b14f63e2077441a0f

  • SHA256

    10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd

  • SHA512

    de6d502b6bb6d6b46d5b0170db2e3f22f376f5370b6fe6793efbe3ea2207e65033d0b3e0b195b90833ec305bd0decffb6264f2dc973160dbdc330646af242d74

  • SSDEEP

    1536:QzICS4A30TY1kUS/U2ztdS1I6DdL9Ta1lx1411ey2NzPBmdy6h+/:vJ0TYyUS/U2RgGWL9+zx1c1eXNNmdA/

Score
10/10

Malware Config

Extracted

Path

C:\Users\wkyNXZoXP.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion Links for the normal browser http://lockbitapt.uz >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: 25516ED9EB2BDF2D1817DA77FF5B6D6E >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt.uz

https://twitter.com/hashtag/lockbit?f=live

http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion

http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion

http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion

http://lockbitsupp.uz

https://tox.chat/download.html

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll,#1
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\ProgramData\DCE7.tmp
        "C:\ProgramData\DCE7.tmp"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: RenamesItself
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DCE7.tmp >> NUL
          4⤵
            PID:2016

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

      Filesize

      103KB

      MD5

      f495d9dde5d0becabfe1c30277e4f0b4

      SHA1

      a3468d9df3c983c8fc7b45c2d41a53bf87aa0aac

      SHA256

      e0046d878e665decf7b0e613ab5b0cd506855ca07510cd0c6359e285173ed154

      SHA512

      829f54686543ccb5f2719b2b7e9afa2e18cf482837cc1d2ada221edbc787cce27f1a2c8c4887fac6322d7346de3857eb6067b5293dffb24a293c3f7bb206da13

    • C:\Users\wkyNXZoXP.README.txt

      Filesize

      3KB

      MD5

      fad0a90c05731e681986c655bf629669

      SHA1

      c262ebf63d90024d4a930e94d07bec1488843718

      SHA256

      52101729b68cab0bee0bfe63ba4a513fe61dd5f4974b057a2a2629a77c2e8a45

      SHA512

      1c9e454889f1fad1f524eee912f4a4c98f4c6ceb73f2b78aad5cbc908d507db225c854d955a406b3616e4ff65efa1eb5c8c009f400203421fb2db239f36cd395

    • \ProgramData\DCE7.tmp

      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    • memory/1644-55-0x0000000002170000-0x00000000021B0000-memory.dmp

      Filesize

      256KB

    • memory/1644-54-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

    • memory/1644-58-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

    • memory/1644-57-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

    • memory/1644-56-0x0000000002170000-0x00000000021B0000-memory.dmp

      Filesize

      256KB

    • memory/1644-89-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

    • memory/1644-90-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

    • memory/2192-40-0x00000000003A0000-0x00000000003E0000-memory.dmp

      Filesize

      256KB

    • memory/2192-0-0x0000000002110000-0x0000000002150000-memory.dmp

      Filesize

      256KB

    • memory/2192-59-0x0000000002110000-0x0000000002150000-memory.dmp

      Filesize

      256KB

    • memory/2192-60-0x00000000003A0000-0x00000000003E0000-memory.dmp

      Filesize

      256KB

    • memory/2192-38-0x00000000003A0000-0x00000000003E0000-memory.dmp

      Filesize

      256KB