lockbit | f566f21f3db0c4a9f421f18e6561279b4dd4c5fd3c32456a6f2e5b927b49719d

Resubmissions

23-05-2024 09:35

28-04-2024 14:29

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:35

Target

LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3_Rundll32_pass.dll
Size

148KB
MD5

1cf36fecacae95acaed46247090fd4b6
SHA1

4dcf048521b7c8fcba54d20f06be6ea60131bce1
SHA256

6eb4d985a52554d37c0efec1457258e4dfd4619ff0396c66e2f9a02d8381ce57
SHA512

7b6c660245ed236a12e4c7e36e30283b5d2736de2d419da60d4ab584016de24dd40f7c4d407c5a4cee3c1995d136a775f72ed2ca16c911d75a2c9c2f4b57a99c
SSDEEP

3072:TTmYfHnIUoQ3+Cv9y5esf+Ieva3YVxz8jZGhjhjGI:TBvn3+WnSev7VujMzf

Score

10^/10

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
behavioral6/memory/4564-0-0x0000000010000000-0x0000000010029000-memory.dmp	family_lockbit

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 4564	1764	rundll32.exe	85
PID 1764 wrote to memory of 4564	1764	rundll32.exe	85
PID 1764 wrote to memory of 4564	1764	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32_pass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32_pass.dll,#1
  2⤵
  PID:4564

memory/4564-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download