Overview

overview

10

Static

static

10

LB3.exe

windows7-x64

10

LB3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 20:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LB3.exe

  • Size

    146KB

  • MD5

    2357ecbcf3b566c76c839daf7ecf2681

  • SHA1

    89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58

  • SHA256

    0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305

  • SHA512

    bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3C8EAC4F3671E50F4F >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

  • Renames multiple (631) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LB3.exe
    "C:\Users\Admin\AppData\Local\Temp\LB3.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:668
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3980
    • C:\ProgramData\1096.tmp
      "C:\ProgramData\1096.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:512
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1096.tmp >> NUL
        3⤵
          PID:828
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3712
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D5FD3C75-C9B2-43B8-B1B1-9FFAD401BD26}.xps" 133654608722760000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:4736

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-2650514177-1034912467-4025611726-1000\AAAAAAAAAAA
        Filesize

        129B

        MD5

        af5c31f1bf1bfcaf5f9f607f7d6e81c7

        SHA1

        3e8b73fa1fbe9752f5079c5feb59b565f689762f

        SHA256

        b8579ca794ae98f7ae2ae05ef47469dc43a9f632c8ce6328bb6dd572b3dc48d3

        SHA512

        ecd067b14f185410c6cb14729e5b952f8b7f0157c9fa69a7afa56a886d84c6ceb2c185531036c47a8cdd6d0d01f6b5efa8064e64ab3a7987748c82067942bd1e

        Download Submit

      • C:\7V7uPExzv.README.txt
        Filesize

        1KB

        MD5

        51a919880af0593fdea5e9f025f0b52a

        SHA1

        0a6aafc30edce6958323b6ead5a8d490bd479ed5

        SHA256

        1f8538d5ec8198305f1d02641ba49b348a4cd414ef12de595dc8ddff941e7c24

        SHA512

        6d5b49b9f4c1e93cca1b4b027493ef5f2a6a1c324923c41b4935badb1695a0d76fc70f69e5c1750dd1ee6cbc2c2b8313990b91c15745065b1d77d0909fca22f8

        Download Submit

      • C:\ProgramData\1096.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\EEEEEEE
        Filesize

        146KB

        MD5

        8698724b68882847189ad12784b6f5b8

        SHA1

        0aa4d4b478dce9521bf2ae33bbb8a487901c447e

        SHA256

        1cb3a4f336d6c0bca46fc4ff3eb016259205ca86f8ecc71b0289540fa61381dc

        SHA512

        c99ffdd90dea640f3a8a4ec8d635f031a5b86980cba26036e58b7f8e2893a07792e8a37f46d8b93fa045fdd2ea15e50a502bc66aa49da76da22ee41e322c6a5f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\{740AAEBD-BDBA-46DB-B47A-38F2ABB1BF02}
        Filesize

        4KB

        MD5

        f8dc0d39b51a0e3f77e8f692bca6ae98

        SHA1

        6f547cc5295c11f0cda2031b7803323f31f6828f

        SHA256

        b349bb4d43db4cf923a2c217b0e9d2e029f7a22f4629735f610aa07935f742bc

        SHA512

        1e836da7996c5bceb735c0b4da4c7f7ca30125e06a95e217ea6d3c9646b38b83d62f7c5314710a1a4abb0195ae10ce4d9d9fd47a6a0204f62395a538cb835115

        Download Submit

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
        Filesize

        4KB

        MD5

        ae29bebaf7d678dd2c6f379da4e13f0c

        SHA1

        bbe898ad06e49b078fe7177f3f23f262a324400e

        SHA256

        de7a587830e9da49d2965690ad94454da5eb67befd7dc061f09cd2a8ee978c5f

        SHA512

        e5b384c0390c5a05b8d21626c0254b8dc232aadc8a09621837c6ed1e5656fe9001f4a6c6d222e84259163d0ff140c8769bbf7aa5c4bc1ef143b8df48b6522265

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-2650514177-1034912467-4025611726-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        9f7319fe4f5941aae8a22a9e8512508c

        SHA1

        bfa00a432cd2870427ff7003386d97f55e766bc8

        SHA256

        a093feb37ed44263cca848c73ba029bca2e55ed9acbc83998feef5e13926f0db

        SHA512

        fbd6e8d5eda2d8469180193b16173abed2b9c6a0968ebcf9a393485e27f90fe16f3d3122d41ba8ed63692f31f3facce1a71a9b25c29024d68acca72033649dc8

        Download Submit

      • memory/668-2-0x0000000003000000-0x0000000003010000-memory.dmp

        Filesize

        64KB

        Download

      • memory/668-0-0x0000000003000000-0x0000000003010000-memory.dmp

        Filesize

        64KB

        Download

      • memory/668-1-0x0000000003000000-0x0000000003010000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4736-2986-0x00007FFAAD3D0000-0x00007FFAAD3E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4736-2985-0x00007FFAAD3D0000-0x00007FFAAD3E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4736-2984-0x00007FFAAD3D0000-0x00007FFAAD3E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4736-3018-0x00007FFAAB180000-0x00007FFAAB190000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4736-3019-0x00007FFAAB180000-0x00007FFAAB190000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4736-2981-0x00007FFAAD3D0000-0x00007FFAAD3E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4736-2983-0x00007FFAAD3D0000-0x00007FFAAD3E0000-memory.dmp

        Filesize

        64KB

        Download