Overview

overview

10

Static

static

10

LockBit-main.zip

windows10-2004-x64

10

Resubmissions

17-04-2024 10:53

240417-my9fhaeb8s 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LockBit-main.zip

  • Size

    292KB

  • Sample

    240415-c3fc4sfa9x

  • MD5

    68309717a780fd8b4d1a1680874d3e12

  • SHA1

    4cfe4f5bbd98fa7e966184e647910d675cdbda43

  • SHA256

    707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881

  • SHA512

    e16de0338b1e1487803d37da66d16bc2f2644138615cbce648ae355f088912a04d1ce128a44797ff8c4dfc53c998058432052746c98c687670e4100194013149

  • SSDEEP

    6144:n42LBVCsV+PkMeW9zTiY/NaQmHst5ySPzmcfIMwmafvR:n4EzwkMeWgY1NmyESPB1/aXR

Score
10/10
blackmatterlockbitransomwarespywarestealer

Malware Config

Extracted

Family

blackmatter

Version

25.239

Targets

    • Target

      LockBit-main.zip

    • Size

      292KB

    • MD5

      68309717a780fd8b4d1a1680874d3e12

    • SHA1

      4cfe4f5bbd98fa7e966184e647910d675cdbda43

    • SHA256

      707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881

    • SHA512

      e16de0338b1e1487803d37da66d16bc2f2644138615cbce648ae355f088912a04d1ce128a44797ff8c4dfc53c998058432052746c98c687670e4100194013149

    • SSDEEP

      6144:n42LBVCsV+PkMeW9zTiY/NaQmHst5ySPzmcfIMwmafvR:n4EzwkMeWgY1NmyESPB1/aXR

    Score
    10/10
    lockbitransomwarespywarestealer

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Rule to detect Lockbit 3.0 ransomware Windows payload

    • Renames multiple (705) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks