Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 18:08
Behavioral task
behavioral1
Sample
LBLeak/Build.bat
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
LBLeak/Build.bat
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
LBLeak/builder.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
LBLeak/builder.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
LBLeak/keygen.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
LBLeak/keygen.exe
Resource
win10v2004-20240704-en
General
-
Target
LBLeak/Build.bat
-
Size
741B
-
MD5
4e46e28b2e61643f6af70a8b19e5cb1f
-
SHA1
804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
-
SHA256
8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
-
SHA512
009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4384 wrote to memory of 2884 4384 cmd.exe 83 PID 4384 wrote to memory of 2884 4384 cmd.exe 83 PID 4384 wrote to memory of 2884 4384 cmd.exe 83 PID 4384 wrote to memory of 4328 4384 cmd.exe 85 PID 4384 wrote to memory of 4328 4384 cmd.exe 85 PID 4384 wrote to memory of 4328 4384 cmd.exe 85 PID 4384 wrote to memory of 4764 4384 cmd.exe 86 PID 4384 wrote to memory of 4764 4384 cmd.exe 86 PID 4384 wrote to memory of 4764 4384 cmd.exe 86 PID 4384 wrote to memory of 1448 4384 cmd.exe 87 PID 4384 wrote to memory of 1448 4384 cmd.exe 87 PID 4384 wrote to memory of 1448 4384 cmd.exe 87 PID 4384 wrote to memory of 2292 4384 cmd.exe 88 PID 4384 wrote to memory of 2292 4384 cmd.exe 88 PID 4384 wrote to memory of 2292 4384 cmd.exe 88 PID 4384 wrote to memory of 4204 4384 cmd.exe 89 PID 4384 wrote to memory of 4204 4384 cmd.exe 89 PID 4384 wrote to memory of 4204 4384 cmd.exe 89 PID 4384 wrote to memory of 1364 4384 cmd.exe 90 PID 4384 wrote to memory of 1364 4384 cmd.exe 90 PID 4384 wrote to memory of 1364 4384 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LBLeak\Build.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\LBLeak\keygen.exekeygen -path C:\Users\Admin\AppData\Local\Temp\LBLeak\Build -pubkey pub.key -privkey priv.key2⤵PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exebuilder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3Decryptor.exe2⤵PID:4328
-
-
C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exebuilder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3.exe2⤵PID:4764
-
-
C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exebuilder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_pass.exe2⤵PID:1448
-
-
C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exebuilder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_Rundll32.dll2⤵PID:2292
-
-
C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exebuilder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_Rundll32_pass.dll2⤵PID:4204
-
-
C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exebuilder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll2⤵PID:1364
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD5a07c35de95c5ec443b1f24b457ade787
SHA1b2972e3edc67b385ca788c7c26c2b5b369cd7b00
SHA2562c5636a3340afb494c10dce408efa446ccb4115e215e281697ee23a045f6a669
SHA512a5237c2f98fb817158947f3b0cad02ac7f3b36a8046b3c8dade661746d08d344455b27895f1812c29c1b8b97ed5ea047e0cf28efa9d986e9c4a93bd4fa94e408
-
Filesize
344B
MD587954f3db954fdda61f4225a36e393d1
SHA141e9465c5f6e103e52258afe25d17d2cbdb86c96
SHA2564371cef4b5b4a16c08dbe4f3b2d16ed83edc4bd9ba918899354998018ff0698a
SHA5128ee6484c2581e8876d431a1bdc833b00f22bd9cdfb514abf0e092a009621e1424ac60937545b3a0f7a5152a702e906ba85a23172657aded9192538d938ebf799