General
-
Target
16164055578.zip
-
Size
164KB
-
Sample
240326-pmxcxaab35
-
MD5
788b386b87e47b118b2c6be1cca36f26
-
SHA1
90a9f65e22c6486781e95e3af1ac2829b0c317f9
-
SHA256
fc89921e856b9d6ce26439ca03bdfab0466ee61e8f55a0dd76627e77e2f9eaf0
-
SHA512
6158881892e3c6ac15dbf85f83c891edd1684d5f81bfe994e8cc8e8b79464b5c3fa1f7926562a48ab347498e1a5cac896e567ef94b96320aabd90aeb857afb9a
-
SSDEEP
3072:yn23Hycr0SKkkCzw1dNa58yTuzvlmlFW06jszu9sNk/T5cdPBKgh:VytSK/YkdMyKurMW064SaNvigh
Static task
static1
Behavioral task
behavioral1
Sample
d07cd2bf0e93802b19094658a70e01e67a1f25e7cb13cfe890020be0c6df55b7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d07cd2bf0e93802b19094658a70e01e67a1f25e7cb13cfe890020be0c6df55b7.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\4adERwmcM.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Extracted
C:\Users\4adERwmcM.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Targets
-
-
Target
d07cd2bf0e93802b19094658a70e01e67a1f25e7cb13cfe890020be0c6df55b7
-
Size
241KB
-
MD5
7c400a0f4b899e0bce10d68aa2fc42bd
-
SHA1
00d8b53bda8383089f880ccc6ea4b4d48aaf5c83
-
SHA256
d07cd2bf0e93802b19094658a70e01e67a1f25e7cb13cfe890020be0c6df55b7
-
SHA512
b75edc0d897d2948b2f3969421d9eb81f856a79572210c02d2935eb846deb313a5e2a8b95b313a2daa987349a506bc8edf9e3e9f58138a04496ef1b74bebcbd4
-
SSDEEP
3072:SYNS0Zz0w+Sc/bqrTlAy2JxjtdkDljO2jWL7ohJS5JRraPgwW:jz0f76ghtdQ47LQORm9
Score10/10-
Renames multiple (194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-