lockbit | 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
11-07-2024 13:37

Target

{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
Size

162KB
MD5

38745539b71cf201bb502437f891d799
SHA1

f2a72bee623659d3ba16b365024020868246d901
SHA256

80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
SHA512

772e76757069c3375cf1ffd659ff03f47f2d4becae61a852adbc27ae467551210d8832994f944c05fccc8486a8a88322021c94217a8bd962c2459af41067132b
SSDEEP

3072:MC/pu0EzJTnvxkIKztqGJ0OtiZ4/7I5jfa2F63Jvb3iN0RD3xpjb68Tzd4Tpx8W7:MC/pu1iIKztqGuU/7Ity2F65vb3FRlpW

Score

10^/10

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2768-0-0x0000000000400000-0x000000000042C000-memory.dmp	family_lockbit
behavioral1/memory/2768-1-0x0000000000400000-0x000000000042C000-memory.dmp	family_lockbit

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
5780	2768	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
"C:\Users\Admin\AppData\Local\Temp\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
1⤵
PID:2768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 276
  2⤵
  - Program crash
  PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2768 -ip 2768
1⤵
PID:4976

memory/2768-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2768-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download