General
-
Target
16202532093.zip
-
Size
159KB
-
Sample
240326-prdrcsac27
-
MD5
a112f7dcc6b0eb2ee7f803dced7c004e
-
SHA1
b3c983c9e049979e05354831718e5a7f77cae039
-
SHA256
bcd08f5b06d5df101d51ff6f20252d1ce20071a713625f50d8f840d538853dd5
-
SHA512
1e2e7cceebf87c5e6fdbd196ea0298f9bc2de9c8a0daf217ed6238f98f3751620f448ad7cccd1c6169c4fa0bd1f5c69c56a972f1936b8ae8098e35a9d29ca7c8
-
SSDEEP
3072:UIuFww6j4kb28I+sLGzg8+6WRmURJWWWBwJgSF4R1Zt9W0:UIu690qYLIAjRJHW4gtR1ZtY0
Static task
static1
Behavioral task
behavioral1
Sample
73b4c516c21979840ac94aa1db830d0b2d6ad2746c7d89a5bd76d36190bbdbaf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
73b4c516c21979840ac94aa1db830d0b2d6ad2746c7d89a5bd76d36190bbdbaf.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\BfUuixlUp.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Extracted
C:\Users\BfUuixlUp.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Targets
-
-
Target
73b4c516c21979840ac94aa1db830d0b2d6ad2746c7d89a5bd76d36190bbdbaf
-
Size
212KB
-
MD5
0dc7a3ddfc6a8526d901a4bf1a582771
-
SHA1
3aa3708c82128733553f8b04cb0003358643ee23
-
SHA256
73b4c516c21979840ac94aa1db830d0b2d6ad2746c7d89a5bd76d36190bbdbaf
-
SHA512
5fd2fb6e661a3cc518b388612afbdd7327f64fe71f4f6b27a4ddec0db15ccc24f93f16781981877dbe55e8a5d471734abc630e601af2ecc50aa687ab3dcf7f6c
-
SSDEEP
3072:cU5iX+kkrOhuHFDuQrE99FEx/eOyUQBuz4q6fSIZgvOHNrR/iXs:cyiX+kiOhucEZyUQBgvNaskrR/i8
Score10/10-
Renames multiple (168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-