lockbit | 30cf476cf309662b96c237d3778afc6a33ca512d76d1daa9deb2a4c7fa2ef408

General

Target

bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe
Size

512KB
MD5

ca9030325048d92594bc29ec5d6e5b6e
SHA1

b65183cc886185a8c34860f68d3289d8e9dd84e3
SHA256

bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6
SHA512

112e69453ee1289302ed7f9ca5a885be6b74e6d18a34cb61d976874f833ae9cb61b31a8cbf6a636ea5cedef87d3fd781bcff8499e477f87c61926d7ea6b7de56
SSDEEP

12288:vubsNSOetfARQAPyGUJWX+t4IbhYR6H6/ou6BEZEQ4Gfw28:vubsnafAPyjJUIbKcH6AqZENP

Score

10^/10

lockbit ransomware spyware stealer

Malware Config

Extracted

Path

C:\Uc2RrigQ4.README.txt

Ransom Note

~~~ Ikaruz Red Team the world's Simple Ransomware Since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: DD569E4494EC647A74230BF6F58F2D7A >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

Emails

[email protected]

URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

http://lockbitapt.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\RarSFX0\lb3.exe	family_lockbit

Renames multiple (289) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 2 IoCs

Processes:

lb3.exe1FA1.tmp

pid process

1916 lb3.exe
948 1FA1.tmp

Loads dropped DLL 5 IoCs

Processes:

bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exelb3.exe

pid	process
1936	bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe
1936	bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe
1936	bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe
1936	bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe
1916	lb3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

lb3.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini	lb3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini	lb3.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

lb3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Uc2RrigQ4.bmp"	lb3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Uc2RrigQ4.bmp"	lb3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

1FA1.tmp

pid process

948 1FA1.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
948	1FA1.tmp

Modifies Control Panel 2 IoCs

evasion

Processes:

lb3.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop	lb3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "10"	lb3.exe

Modifies registry class 5 IoCs

Processes:

lb3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Uc2RrigQ4\DefaultIcon\ = "C:\\ProgramData\\Uc2RrigQ4.ico"	lb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Uc2RrigQ4	lb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Uc2RrigQ4\ = "Uc2RrigQ4"	lb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Uc2RrigQ4\DefaultIcon	lb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Uc2RrigQ4	lb3.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

lb3.exe

pid	process
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe
1916	lb3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

lb3.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeDebugPrivilege	1916	lb3.exe
Token: 36	1916	lb3.exe
Token: SeImpersonatePrivilege	1916	lb3.exe
Token: SeIncBasePriorityPrivilege	1916	lb3.exe
Token: SeIncreaseQuotaPrivilege	1916	lb3.exe
Token: 33	1916	lb3.exe
Token: SeManageVolumePrivilege	1916	lb3.exe
Token: SeProfSingleProcessPrivilege	1916	lb3.exe
Token: SeRestorePrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSystemProfilePrivilege	1916	lb3.exe
Token: SeTakeOwnershipPrivilege	1916	lb3.exe
Token: SeShutdownPrivilege	1916	lb3.exe
Token: SeDebugPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeBackupPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe
Token: SeSecurityPrivilege	1916	lb3.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exelb3.exe1FA1.tmp

description	pid	process	target process
PID 1936 wrote to memory of 1916	1936	bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe	lb3.exe
PID 1936 wrote to memory of 1916	1936	bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe	lb3.exe
PID 1936 wrote to memory of 1916	1936	bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe	lb3.exe
PID 1936 wrote to memory of 1916	1936	bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe	lb3.exe
PID 1916 wrote to memory of 948	1916	lb3.exe	1FA1.tmp
PID 1916 wrote to memory of 948	1916	lb3.exe	1FA1.tmp
PID 1916 wrote to memory of 948	1916	lb3.exe	1FA1.tmp
PID 1916 wrote to memory of 948	1916	lb3.exe	1FA1.tmp
PID 1916 wrote to memory of 948	1916	lb3.exe	1FA1.tmp
PID 948 wrote to memory of 1464	948	1FA1.tmp	cmd.exe
PID 948 wrote to memory of 1464	948	1FA1.tmp	cmd.exe
PID 948 wrote to memory of 1464	948	1FA1.tmp	cmd.exe
PID 948 wrote to memory of 1464	948	1FA1.tmp	cmd.exe

C:\Users\Admin\AppData\Local\Temp\bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe
"C:\Users\Admin\AppData\Local\Temp\bfa1a2bd23754277ee1f31e80c92d9c5309f150083451bfc33bbeb604adec8f6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936

C:\Users\Admin\AppData\Local\Temp\RarSFX0\lb3.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\lb3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916

C:\ProgramData\1FA1.tmp
"C:\ProgramData\1FA1.tmp"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1FA1.tmp >> NUL
4⤵
PID:1464

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x148
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\CCCCCCCCCCC

Filesize
129B

MD5
ba5fb060622257d56d198b4790385fae

SHA1
7190ef11ebd209b261adc464379b047ee8c6ee1b

SHA256
1b34b8a6beb201cd73468ba988bc7586acc183ca56348b0d68a6becb0da6188c

SHA512
a6e3d2c69afb5105aaf3eb5533c4f0685fb36f2fc66ecee6ab82f2d600bb7b82f6919ac881d318b66722f028768fd4f8e9243872cce0b74411c2a19b018aca6c

Download Submit
C:\Uc2RrigQ4.README.txt

Filesize
6KB

MD5
0297c6708ced6e89d969a65fd415d824

SHA1
9220900f0c6ec4562678987c72a4dc08131c7004

SHA256
10f7632622828aef9f1ad128be906d55a9f8f4e220a214578a479add4546e3f2

SHA512
deacd3f28b8e43bc676b2cd98f13335bf32d5293f41b684fd295cd007b32572407c96071be9a978e4f617fd92ec2ab45415745e9da019213ac19448cfc602040

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lb3.exe

Filesize
153KB

MD5
642cb5a692e2762919d062ef18ebd4b7

SHA1
28f478a68afaef115a2e6208705dae96311e1b5f

SHA256
446a17513a595eed37463d257a8ecab45f9dddad4e4bc61d0808e047e025a6dd

SHA512
39c0497588a63bbe7573354a31c677f6be13a85a5d9c14836c63412d38e5467916751bb28a9859996ae4821a2fd65f932f675cb8149782fa403c6870b69b3d5f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\DDDDDDDDDDD

Filesize
129B

MD5
5d7b061c94b8eb77c010eb08045e200c

SHA1
61112c13fe0c49ba9be4d3c38af73e15f03657e6

SHA256
e8b5da8c41e610d9d3931f7e7537adb18634ff3e53b334271cbb87ceacf998a0

SHA512
2390345d84106bc00ce02094b42c0459819a40a4bbb15254efaeec55aff66c52e1f797b16e5a76fb7d38a9ca732efc212d29a3ce549640d4777e76ac06e5bb63

Download Submit
\ProgramData\1FA1.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\lb3.exe

Filesize
153KB

MD5
8861ae48d8a851e1573586ac4b7ed230

SHA1
a379e55be365ece1ca2b8f72b6c54bb8b5bfe4e9

SHA256
c9dd51d4295c33e1df0d275669a1de9e1de374a51eb88d7f7b1a1e65f49f7794

SHA512
2b6c452ec52e76c0e0750e3a94041cb7103fd36c5257067bb965cdb50af431fb55323c88e7b0c5b7f51a35be10f5cb60cc600a9dcece67093c6898603de61123

Download Submit
memory/948-818-0x000000007EF80000-0x000000007EF81000-memory.dmp

Filesize
4KB

Download
memory/948-817-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Filesize
4KB

Download
memory/948-848-0x000000007EF60000-0x000000007EF61000-memory.dmp

Filesize
4KB

Download
memory/1916-18-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads