lockbit | 49932b024cceecac0013a8d741873f0b5d5ed2c2010453571eb7c8d4ab8e17ca

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 02:27

Target
2024-03-19_22513dd8432b63f20061aa80f8a99f40_lockbit.exe
Size 149KB
Sample240319-cxvkvaeh79
SHA256 49932b024cceecac0013a8d741873f0b5d5ed2c2010453571eb7c8d4ab8e17ca
MD5 22513dd8432b63f20061aa80f8a99f40
SHA1 3442faf186ec048c2ea0dbbd6453ef6f33727c42
SHA512 5fb716cb87b5c4df31229d3fbda4e0e8ee690c503ef13b13f7e6311e3eb2521461deb9c7cf3473f26994db4c42314b20960724fabac38b8b826b6a68cbe6f317
SSDEEP 3072:X46jN7obZHkHyqnc9dhiwNhWSrvj5/nPKYg0d1LDun1vHYRZv5vVGXnRNn0jHhvq:X46jqVESqnohHNPH5fmIJDunODRvyf0M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs

resource	yara_rule
behavioral2/memory/3480-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_lockbit
behavioral2/memory/3480-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_lockbit

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3472	3480	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-03-19_22513dd8432b63f20061aa80f8a99f40_lockbit.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_22513dd8432b63f20061aa80f8a99f40_lockbit.exe"
1⤵
PID:3480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 264
  2⤵
  - Program crash
  PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3480 -ip 3480
1⤵
PID:512

memory/3480-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3480-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download