Analysis
-
max time kernel
92s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 04:33
Static task
static1
Behavioral task
behavioral1
Sample
80d96ecbfcac0d4d69d1e8bd3f8e16ff6b0c4eb128f2249f60dae34914394286.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
80d96ecbfcac0d4d69d1e8bd3f8e16ff6b0c4eb128f2249f60dae34914394286.dll
Resource
win10v2004-20240426-en
General
-
Target
80d96ecbfcac0d4d69d1e8bd3f8e16ff6b0c4eb128f2249f60dae34914394286.dll
-
Size
341KB
-
MD5
9421cbaea34e9ddbccf2c5078b60d39b
-
SHA1
1c5d8e2507725a4f3b3112ace1cf6a9508ad7faf
-
SHA256
80d96ecbfcac0d4d69d1e8bd3f8e16ff6b0c4eb128f2249f60dae34914394286
-
SHA512
7b64682570738484baf9f729d12a81c2342c190c013d01bd0bfbc4f2a33aea1b4aea2e0568ca8697a1ca77d250df302d911de05d341fd3b5e7f0ff0069dbb34b
-
SSDEEP
6144:oRoMs1x0iI9YhGdQkVz/4+HzkLkdlfzjtVnXPlfBTzMiekdMXb1hq:oRLMx0iUdPVjTfd9zjt1zEGdMy
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Rule to detect Lockbit 3.0 ransomware Windows payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3036-3-0x0000000010000000-0x0000000010044000-memory.dmp family_lockbit behavioral2/memory/3036-6-0x0000000010000000-0x0000000010044000-memory.dmp family_lockbit behavioral2/memory/3036-7-0x0000000010000000-0x0000000010044000-memory.dmp family_lockbit behavioral2/memory/3036-1-0x0000000010000000-0x0000000010044000-memory.dmp family_lockbit -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 2272 wrote to memory of 3036 2272 rundll32.exe 81 PID 2272 wrote to memory of 3036 2272 rundll32.exe 81 PID 2272 wrote to memory of 3036 2272 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\80d96ecbfcac0d4d69d1e8bd3f8e16ff6b0c4eb128f2249f60dae34914394286.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\80d96ecbfcac0d4d69d1e8bd3f8e16ff6b0c4eb128f2249f60dae34914394286.dll,#12⤵PID:3036
-