Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit
-
Size
140KB
-
MD5
adee08d1d86e361d08ced8adc8ab17dc
-
SHA1
4ff5efcf97516cb1ef4c07fc04bab0d3b9fc1b6f
-
SHA256
1d79d85948aa4c62b8367f233b088d9adb00915475a559f7e163e12edf9b9ccb
-
SHA512
34dc8efffd83294103007003c4f95fcdf0cdb40d8f8036c6f7413bf8711a7e475beea1ca599103ceeddfb3c1f3e00985923233117f4684df3dcea02a2de04d10
-
SSDEEP
3072:iU8E2JPpYg/GGo2l+mL3iUfqMqqD/KqEA8PC:QE2pHNo2wW3r5qqD/2T
Malware Config
Signatures
-
Detects command variations typically used by ransomware 1 IoCs
Processes:
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit
Files
-
2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE