Overview

overview

10

Static

static

10

Lockbit4.exe

windows7-x64

10

Lockbit4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2024, 02:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Lockbit4.exe

  • Size

    146KB

  • MD5

    e544b3593a6441f9654839e11aa0bea5

  • SHA1

    f7d5e39e1b031002887b4a7d8a8ef889c892c3e7

  • SHA256

    9b5f1ec1ca04344582d1eca400b4a21dfff89bc650aba4715edd7efb089d8141

  • SHA512

    9c6f2a04307b0a41e9aaf7c9c68dd901787d7ad65e80f293893c21e026e2de11b729b0fdbeb0c0926214e85d9b4c3473e94017be2e0fb49ed5a91fdff7ca9e83

  • SSDEEP

    1536:KzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD3pt0uCM0Ej+/dO9fRQvffQBfFT:5qJogYkcSNm9V7D5NuEBfWf4BfFT

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\xa1Xx3AXs.README.txt

Ransom Note
~~~ LockBit 4.0 Ransomware since 2024~~~ >>>> Your data are stolen and encrypted Price = 1000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: A3138014A48684D6D525F3F372263313 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Signatures

  • Renames multiple (8920) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lockbit4.exe
    "C:\Users\Admin\AppData\Local\Temp\Lockbit4.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\ProgramData\88BF.tmp
      "C:\ProgramData\88BF.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\88BF.tmp >> NUL
        3⤵
          PID:2536
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x148
      1⤵
        PID:2988

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini
              Filesize

              129B

              MD5

              7b7c6a6a6be3d45eaa71c5cca1a89920

              SHA1

              c2b6edc5c7729b7334266ff0642040612b211d6a

              SHA256

              de61253b9a83ab8c5d429cc92cf5af742c865126b5f739de34fab4cdc4ebbf0c

              SHA512

              f8dc3cd9bcd864a87b41a8a29ad46a0e738ff0852bfb5f11276817261c3caf40c469deaa08282355935a9bd012ad82043985d4495d20dd30b5e801f72d171763

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDD
              Filesize

              146KB

              MD5

              37c64a77162c3da350ed13aac4598391

              SHA1

              8f94602191f42a879b4a72fb6e3c2e6f6f4a3061

              SHA256

              cc9651de0b63554939896923074007f3623777222c20b513fe3fe7068d3c189c

              SHA512

              4e3ea97443ad8cc17c87c6133858756e0fac9228c44f82e312e7cac7db9384db2fc60579c12fe37510a2fc6e9a20bb03d68f138cb8ef38c65102735aa9232a98

              Download Submit

            • C:\xa1Xx3AXs.README.txt
              Filesize

              1KB

              MD5

              b086e40671776e1878d78e5b77d87b29

              SHA1

              afc25200704f5e355a80a719e86a450295177606

              SHA256

              c99243fd5b4b2b5be708c0f30d095e515517f1e26a01032d05ad5ec6d6e4e2e3

              SHA512

              e813443a43ec149dc783d8f41c7e0abebf79ffa2718c33747a8d4a5cdc7ea1f9cbbc7ca7b2738ed4b724f246b0c56fa9f48c19f941174ddfc976216221480474

              Download Submit

            • F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\BBBBBBBBBBB
              Filesize

              129B

              MD5

              1679f1027eaeac84b361a57d62514532

              SHA1

              273f469ace8bb62a0c59e80bf39dabbf41f16e05

              SHA256

              b57344dc27c56065c1dd2cf0b9f119a35d8ca9778ef5a0da23f2a1d61560bda6

              SHA512

              1251a4d96dc7ddc828df48d896a9af8dda65ec162d3cc39566a20356d8d6dfca2a558aa5585a1e73e55acab95ed2476aa09220f2e94f2868ce3f073261e81ce5

              Download Submit

            • \ProgramData\88BF.tmp
              Filesize

              14KB

              MD5

              294e9f64cb1642dd89229fff0592856b

              SHA1

              97b148c27f3da29ba7b18d6aee8a0db9102f47c9

              SHA256

              917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

              SHA512

              b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

              Download Submit

            • memory/2276-0-0x00000000002A0000-0x00000000002E0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2596-12839-0x0000000000280000-0x00000000002C0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2596-12837-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2596-12845-0x0000000000280000-0x00000000002C0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2596-12847-0x000000007EF80000-0x000000007EF81000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2596-12849-0x000000007EF20000-0x000000007EF21000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2596-12870-0x000000007EF40000-0x000000007EF41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2596-12871-0x000000007EF60000-0x000000007EF61000-memory.dmp

              Filesize

              4KB

              Download