f566f21f3db0c4a9f421f18e6561279b4dd4c5fd3c32456a6f2e5b927b49719d

Resubmissions

23-05-2024 09:35

240523-lkmh5scb37 10

28-04-2024 14:29

240428-rth5zahg49 10

Analysis

max time kernel
11s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build.bat
Size

733B
MD5

1905cc9973206fea5050b737f9303fb4
SHA1

497524177d9478a4b5dca3e73cc230be6abf4ce0
SHA256

e2f5b93040d57de6251d16256bcd04aa8eb337bde87308e602f01070efd345fb
SHA512

95bae9406d01083f6fe6916ecf8e889afe20ff5863070f1787dc7a60d2d1d5af2cf3fd481a3c4fb531f16dd2cb7a685002aaac1dc907cf189c19c60f2816dd76

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1660	5024	cmd.exe	83
PID 5024 wrote to memory of 1660	5024	cmd.exe	83
PID 5024 wrote to memory of 1660	5024	cmd.exe	83
PID 5024 wrote to memory of 2252	5024	cmd.exe	84
PID 5024 wrote to memory of 2252	5024	cmd.exe	84
PID 5024 wrote to memory of 2252	5024	cmd.exe	84
PID 5024 wrote to memory of 992	5024	cmd.exe	85
PID 5024 wrote to memory of 992	5024	cmd.exe	85
PID 5024 wrote to memory of 992	5024	cmd.exe	85
PID 5024 wrote to memory of 512	5024	cmd.exe	86
PID 5024 wrote to memory of 512	5024	cmd.exe	86
PID 5024 wrote to memory of 512	5024	cmd.exe	86
PID 5024 wrote to memory of 3520	5024	cmd.exe	87
PID 5024 wrote to memory of 3520	5024	cmd.exe	87
PID 5024 wrote to memory of 3520	5024	cmd.exe	87
PID 5024 wrote to memory of 4964	5024	cmd.exe	88
PID 5024 wrote to memory of 4964	5024	cmd.exe	88
PID 5024 wrote to memory of 4964	5024	cmd.exe	88
PID 5024 wrote to memory of 2580	5024	cmd.exe	89
PID 5024 wrote to memory of 2580	5024	cmd.exe	89
PID 5024 wrote to memory of 2580	5024	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build -pubkey pub.key -privkey priv.key
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe
  2⤵
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe
  2⤵
  PID:992
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe
  2⤵
  PID:512
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32.dll
  2⤵
  PID:3520
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32_pass.dll
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\priv.key

Filesize
344B

MD5
4a3d97c6156a3c70ac7d04c4811bffd7

SHA1
ebd1a0deeb65ad6147b3979a461adc582d090163

SHA256
f1be5c3db6fddf77258ea68dc04dc643a9fd32596d26d4055a96967f881ae22b

SHA512
4cfa881448c2fee2da9157e14d66cdd3c629f637fcad08b8f21088384be8daec1494fefbc23478c7626a06884d79a90a864fbfbf696d65b9c1968c5ee7723ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\pub.key

Filesize
344B

MD5
e59ac9446c5310349b40d8cdd92e3c90

SHA1
8639f29cdc376ae4a45b39f3a7c536039fb250bb

SHA256
0b2441c6fb97211503a69bc4f4bff2820d2006d3cfca2024491dd5f86d9ec47d

SHA512
46534128fee0923e795211bdb3826aa946e97e92e1ea477180c2d4bb01c31173452b73667885c760aeb95c394a9fdd232ca5f29035b12e8ac9b518780f74e017

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads