Overview

overview

10

Static

static

1

bat.bat

windows7-x64

8

bat.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bat.bat

  • Size

    306B

  • Sample

    240710-xhqcssthmk

  • MD5

    b356ccb6be21d42492bb19158842f90c

  • SHA1

    e79f4a517f48a992dedb66df06bb57606d86588e

  • SHA256

    269a98ecf1766f39c6ed52aedda0f97276a8b1ec0e5e824d30fd40c3a67a8897

  • SHA512

    52422b3fbe34dec6f54366388d20964812bb038f900fc00f80875b1f1d0427470d23bd7a62c7ae068f1cbb795877f0ce32dd00dc868a258a16a3a92b5610b002

Score
10/10
lockbitexecutionransomwarespywarestealer

Malware Config

Targets

    • Target

      bat.bat

    • Size

      306B

    • MD5

      b356ccb6be21d42492bb19158842f90c

    • SHA1

      e79f4a517f48a992dedb66df06bb57606d86588e

    • SHA256

      269a98ecf1766f39c6ed52aedda0f97276a8b1ec0e5e824d30fd40c3a67a8897

    • SHA512

      52422b3fbe34dec6f54366388d20964812bb038f900fc00f80875b1f1d0427470d23bd7a62c7ae068f1cbb795877f0ce32dd00dc868a258a16a3a92b5610b002

    Score
    10/10
    executionlockbitransomwarespywarestealer

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Rule to detect Lockbit 3.0 ransomware Windows payload

    • Renames multiple (660) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks