Resubmissions
14-07-2024 22:19
240714-18zkyavdkl 10General
-
Target
7de7ce42cde20847749fa5bc4048cf5cacec8c2bf49169d7d262ea38630640ea.zip
-
Size
95KB
-
Sample
240714-18zkyavdkl
-
MD5
97226028de74295f916309c76b04599e
-
SHA1
aaaadda08d9b4dab49ff2ec41197ebf6d653e340
-
SHA256
8ff70b14c79a3030f28ecdc49bee79f7ee662c811c1dc9589ad9e37fdca38000
-
SHA512
01c4fa6b6f62e0537dea749d34c972e0e41687a97dfa715a29050073962c73d7fbb0547cd03a66312e6bbb79a302002cb2d118fe7453f89aa003bfa134f5fbd6
-
SSDEEP
1536:wtbCVcdmcTWqsr2mRxpe4kL0eNqY1CM80avwVZlJy4amXeZ2k6iAysTqq4N5H5w0:wtuVBWmRxpe4rbYIDeJyhl6594NFJkiF
Behavioral task
behavioral1
Sample
7de7ce42cde20847749fa5bc4048cf5cacec8c2bf49169d7d262ea38630640ea.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7de7ce42cde20847749fa5bc4048cf5cacec8c2bf49169d7d262ea38630640ea.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
C:\Users\bMHeBJMks.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Extracted
C:\Users\bMHeBJMks.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
Targets
-
-
Target
7de7ce42cde20847749fa5bc4048cf5cacec8c2bf49169d7d262ea38630640ea.exe
-
Size
156KB
-
MD5
827fd84e6c235dbb400442390a538441
-
SHA1
f88eafeeb71837534f32d7de483497d8d74fb279
-
SHA256
7de7ce42cde20847749fa5bc4048cf5cacec8c2bf49169d7d262ea38630640ea
-
SHA512
4e6df341e606cdc5ecafd02b7e9ba979502301e5e89aaecf604018d014019ffd6bd26b1380cb316ec1beb8f533df5125e75ec67d8760f7bcd90f883b72199f6b
-
SSDEEP
3072:1DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368yUTtc76PJCW:n5d/zugZqll3OUCuPJ
Score10/10-
Renames multiple (152) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-