Overview

overview

10

Static

static

10

LB3.exe

windows7-x64

9

LB3.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LB3.exe

  • Size

    145KB

  • Sample

    240630-hsv9gaxhjm

  • MD5

    2a704c78d287be6fb1a9324dd3bbd780

  • SHA1

    2f79d2d07b33be225d3d333477c2d2159a471e0e

  • SHA256

    dec9845622a1996d768b0f38b7d7d16e6c76b2572b7e2eac55f678e686d4dc6f

  • SHA512

    a2681bdb05ecb2636958b37a65c32bfd27467b241052133ad7f02bb634ad6e5539718ba810c3568f9cf3d10996cdd255e6632c75565ec40b278cff88713a812d

  • SSDEEP

    3072:S6glyuxE4GsUPnliByocWepLk+B2Rq+V8Lmp:S6gDBGpvEByocWelKq8T

Score
10/10
lockbitransomwarespywarestealer

Malware Config

Targets

    • Target

      LB3.exe

    • Size

      145KB

    • MD5

      2a704c78d287be6fb1a9324dd3bbd780

    • SHA1

      2f79d2d07b33be225d3d333477c2d2159a471e0e

    • SHA256

      dec9845622a1996d768b0f38b7d7d16e6c76b2572b7e2eac55f678e686d4dc6f

    • SHA512

      a2681bdb05ecb2636958b37a65c32bfd27467b241052133ad7f02bb634ad6e5539718ba810c3568f9cf3d10996cdd255e6632c75565ec40b278cff88713a812d

    • SSDEEP

      3072:S6glyuxE4GsUPnliByocWepLk+B2Rq+V8Lmp:S6gDBGpvEByocWelKq8T

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (363) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks