0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305

Resubmissions

14-07-2024 13:00

240714-p8n9es1elq 10

14-07-2024 13:00

240714-p8metstdra 10

18-06-2024 22:58

240618-2xvnaasglk 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LB3.exe
Size

146KB
MD5

2357ecbcf3b566c76c839daf7ecf2681
SHA1

89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58
SHA256

0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305
SHA512

bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401
SSDEEP

3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note

~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3CFD902E45030BF31C >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!

URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

Renames multiple (347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

Processes:

4F48.tmp

pid	Process
928	4F48.tmp

Executes dropped EXE 1 IoCs

Processes:

4F48.tmp

pid	Process
928	4F48.tmp

Loads dropped DLL 1 IoCs

Processes:

LB3.exe

pid	Process
2872	LB3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

LB3.exe

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini	LB3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini	LB3.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

LB3.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp"	LB3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

LB3.exe4F48.tmp

pid	Process
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
928	4F48.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

LB3.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\Desktop	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\Desktop\WallpaperStyle = "10"	LB3.exe

Modifies registry class 5 IoCs

Processes:

LB3.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico"	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv"	LB3.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

LB3.exe

pid	Process
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe
2872	LB3.exe

Suspicious behavior: RenamesItself 26 IoCs

Processes:

4F48.tmp

pid	Process
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp
928	4F48.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

LB3.exe

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeDebugPrivilege	2872	LB3.exe
Token: 36	2872	LB3.exe
Token: SeImpersonatePrivilege	2872	LB3.exe
Token: SeIncBasePriorityPrivilege	2872	LB3.exe
Token: SeIncreaseQuotaPrivilege	2872	LB3.exe
Token: 33	2872	LB3.exe
Token: SeManageVolumePrivilege	2872	LB3.exe
Token: SeProfSingleProcessPrivilege	2872	LB3.exe
Token: SeRestorePrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSystemProfilePrivilege	2872	LB3.exe
Token: SeTakeOwnershipPrivilege	2872	LB3.exe
Token: SeShutdownPrivilege	2872	LB3.exe
Token: SeDebugPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeBackupPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe
Token: SeSecurityPrivilege	2872	LB3.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

LB3.exe4F48.tmp

description	pid	Process	procid_target
PID 2872 wrote to memory of 928	2872	LB3.exe	32
PID 2872 wrote to memory of 928	2872	LB3.exe	32
PID 2872 wrote to memory of 928	2872	LB3.exe	32
PID 2872 wrote to memory of 928	2872	LB3.exe	32
PID 2872 wrote to memory of 928	2872	LB3.exe	32
PID 928 wrote to memory of 976	928	4F48.tmp	33
PID 928 wrote to memory of 976	928	4F48.tmp	33
PID 928 wrote to memory of 976	928	4F48.tmp	33
PID 928 wrote to memory of 976	928	4F48.tmp	33

C:\Users\Admin\AppData\Local\Temp\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\LB3.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\ProgramData\4F48.tmp
  "C:\ProgramData\4F48.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4F48.tmp >> NUL
    3⤵
    PID:976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x148
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini

Filesize
129B

MD5
24721c73ac06b9624e8f2153d2015e89

SHA1
abc14e12555983de397c419ca96c02c392bf57ab

SHA256
260c776ce46dfd6affe4dc03766dfa72e7c416d89e25bbb6ebe53dc44d9ce760

SHA512
07b3cd6652b2ef1343bda3893d9bc45eebfd63aa14884665341d966d01ccab98b3aed52aef3389b444445b49d0908753ce6066eb6361473be520b916a400693e

Download Submit
C:\7V7uPExzv.README.txt

Filesize
1KB

MD5
6306fb14e36a4cbd7e9211740a78be56

SHA1
cdc280ce081a0cad76fcaf2564cdbea23775b3b8

SHA256
81b55286774b9fcd3fb30531a8b19de8cc3cd60eb07a1fe38d2ae11fba7bddac

SHA512
25069f512d6fc8918328bab28c286b0322e66a86dedc5046ece40b4fa1ad2bdfa5e7bd31f49693725192be1fff3a19f9c2b08b8c19d65a16e06d86b1ffe55ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDD

Filesize
146KB

MD5
aa782d98b37823fab5418712850c7eb6

SHA1
6c516f994115d4107ac97effb543863be70aa8d9

SHA256
50273b0ae52cc9299934db8250ae666a56949151d3ce644b62659056e4fe0f5b

SHA512
224655af7184985c36ee082473b5462d28ec605e5d52f6a15f859926ab3bea3d2803b1441e9d594602f77f1c1570096c43c9949573516221dbf112496546aada

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3502430532-24693940-2469786940-1000\DDDDDDDDDDD

Filesize
129B

MD5
353a571622b986c9e027c39c129a0f94

SHA1
109814be86e1d3b2ca92d40a8693f2cb4d14b127

SHA256
292885c62a8852d5921af2d87035e05ca8fd44115cb778e0d0139907b3c65a97

SHA512
61e855029b17bed283feda29a298651d52f40f026c65184eeeb1579411c68b4fd7773de9dbbd680dedfe67a2de45d20800ee324ddbe016f0e36118758fb5df12

Download Submit
\ProgramData\4F48.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
memory/928-887-0x000000007EF20000-0x000000007EF21000-memory.dmp

Filesize
4KB

Download
memory/928-886-0x000000007EF80000-0x000000007EF81000-memory.dmp

Filesize
4KB

Download
memory/928-885-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/928-883-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Filesize
4KB

Download
memory/928-884-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/928-917-0x000000007EF60000-0x000000007EF61000-memory.dmp

Filesize
4KB

Download
memory/928-916-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/2872-0-0x0000000002230000-0x0000000002270000-memory.dmp

Filesize
256KB

Download