lockbit | cc58dcd32a440e7f95d19b653a55c1e2c383efc2bd19443238dd3008c1cbe147

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 04:22

Target
cc58dcd32a440e7f95d19b653a55c1e2c383efc2bd19443238dd3008c1cbe147.exe
Size 142KB
Sample240314-ezheeacf43
SHA256 cc58dcd32a440e7f95d19b653a55c1e2c383efc2bd19443238dd3008c1cbe147
MD5 4b122da82c589d68d15a98ba73997910
SHA1 3e4e31479d739e49af21f381a2be11a4e93d2d22
SHA512 9215fe45b9714916a317abc8715778ad56f8c9cf461b4493a6e66bb10f441f924747af3ab7f80d5c4d2bc6207ac8af31ed529044ced4c5aaecb4975e6211bc22
SSDEEP 3072:5sNRFsG/loOgX68qIAdVcxiUmL+mpSjUMYChsf4Vtr+:+NdNoOgXBqIAdGK+mpSjhn+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs

resource	yara_rule
behavioral2/memory/4396-0-0x0000000000400000-0x0000000000427000-memory.dmp	family_lockbit
behavioral2/memory/4396-1-0x0000000000400000-0x0000000000427000-memory.dmp	family_lockbit

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3080	4396	WerFault.exe	88

C:\Users\Admin\AppData\Local\Temp\cc58dcd32a440e7f95d19b653a55c1e2c383efc2bd19443238dd3008c1cbe147.exe
"C:\Users\Admin\AppData\Local\Temp\cc58dcd32a440e7f95d19b653a55c1e2c383efc2bd19443238dd3008c1cbe147.exe"
1⤵
PID:4396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 264
  2⤵
  - Program crash
  PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4396 -ip 4396
1⤵
PID:2796

memory/4396-0-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4396-1-0x0000000000400000-0x0000000000427000-memory.dmp

Download