lockbit

Resubmissions

29/04/2024, 23:47

240429-3tbaxaea3710

29/04/2024, 23:09

240429-25jkzsdf9z10

29/04/2024, 20:59

240429-zs5xcacd6110

Sharing

Copy URL Twitter E-mail

General

Target
ddbc4908272a1d0f339b58627a6795a7daff257470741474cc9203b9a9a56cd6.zip
Size 15KB
Sample240429-3tbaxaea37
SHA256 6ee15a1416677e66cb9056fe3398a4bf8b2fab1d0d80bceceda2a14ef79e77bd
MD5 8339423b4c3fc3443ffc4289fc8de08e
SHA1 cbc241b285d7eb5e816e7cf4901f94c36d047929
SHA512 c19b9107e68e39fa76079283820864779ea71ef42f06f85cc869c7bb61a5ad618eacb0f2cb5f9cececf6d908d998a3d68bbe1427aa4b53cf8b923a622e268bd0
SSDEEP 384:YrQyVe+JlrhZ2vlvlpz21k61fSu/nOibS1pblGB6mF:YrQge+zdctL2B1fS2Oibwy6mF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  ddbc4908272a1d0f339b58627a6795a7daff257470741474cc9203b9a9a56cd6.exe
- Size 57KB
- SHA256 ddbc4908272a1d0f339b58627a6795a7daff257470741474cc9203b9a9a56cd6
- MD5 273d4bf4641d75dbcf2995eb614a4f51
- SHA1 74a883ce99e89b96b6da50d950fc5cb040c30f3a
- SHA512 2291b9329a3471178f41e23b01e0a49b7d7ca271d15e08bb534a7e82b55530b7bb550de083797efdde1341d4967042bce1226a6c28f3b6bf9472b2142837868b
- SSDEEP 384:66StJb1IcaxWYw1p0G1Ls1QuCm6Ee9nlAnXX5G6ow54gmQhDLU67L2Ro0VxdaA+T:6ZV1Ica4DNps1Qum3OIdGX
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lockbit ransomware spyware stealer
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Rule to detect Lockbit 3.0 ransomware Windows payload
- Renames multiple (261) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (261) files with added filename extension

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2