2024-09-06_044bd99d829f2a4c9ccc29fa65cb24d4_lockbit

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-06_044bd99d829f2a4c9ccc29fa65cb24d4_lockbit
Size

39KB
MD5

044bd99d829f2a4c9ccc29fa65cb24d4
SHA1

46dad8f1f1ce9f3057204005e2260e65c2ecdd0e
SHA256

5fcd61ba5cada7dfc153f400db52a9ac54b2d9e5eef6836172ddfdeb8696ce03
SHA512

48fa208d052c48ccf9eee5d7cbf9f43af1f3c000a8a4d507dfbb46e109c486589a28bab23b7857083ad31452f89e986e4c4c71b57a9c4c477683430fd0ea31e3
SSDEEP

768:JEf/gFsuJmTvK5AxGfM2lvpTSzyBsYw/B8MSyg5S4g8a/3x58evKEYWmVjj5uAzr:Of/zuJmTn2lvpSzyOvBWg8g3xeevKE25

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-06_044bd99d829f2a4c9ccc29fa65cb24d4_lockbit

Files

2024-09-06_044bd99d829f2a4c9ccc29fa65cb24d4_lockbit
.exe windows:5 windows x86 arch:x86

2a45a55dd76530400b6ccc67f08677d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

setsockopt
shutdown
closesocket
htons
getsockname
send
WSAGetLastError
select
WSASocketW
WSAConnect
WSAStartup
getpeername
freeaddrinfo
getaddrinfo
recv

shlwapi

PathRemoveFileSpecA
PathFindFileNameW
PathAddBackslashA
PathRemoveBackslashA
wvnsprintfW
wvnsprintfA
StrStrIW
StrCmpNIW
PathSkipRootW
PathMatchSpecW
PathCombineW
PathUnquoteSpacesW

crypt32

CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

msvcrt

memcpy
sprintf
tolower
strtod
memset
strncmp
_except_handler3

psapi

GetProcessImageFileNameW

kernel32

ReadFile
GetComputerNameExW
GetComputerNameW
CreateDirectoryW
GetModuleHandleW
GetNativeSystemInfo
GetCurrentThread
SetThreadPriority
BeginUpdateResourceW
EnumResourceNamesW
EndUpdateResourceW
LockResource
SizeofResource
UpdateResourceW
lstrlenA
GetCurrentProcessId
HeapValidate
GetProcessHeaps
HeapSetInformation
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetProcAddress
LoadLibraryExW
lstrlenW
WideCharToMultiByte
lstrcpynW
lstrcatW
FreeLibrary
LoadLibraryW
LoadResource
FindResourceW
GetVolumeNameForVolumeMountPointA
DeleteFileW
MoveFileExW
TerminateProcess
WaitForSingleObject
CreateProcessW
CreateEventW
SetFileAttributesW
CloseHandle
WriteFile
CreateFileW
GetTempFileNameW
GetTickCount
GetModuleFileNameW
OpenMutexW
GetFileAttributesW
GetModuleHandleA
Sleep
lstrcpyW
FindClose
FindFirstFileW
GetSystemDirectoryW
CopyFileW
GetCurrentProcess
ExitProcess
SetCurrentDirectoryW
CreateThread
SetFilePointerEx
GetUserDefaultLCID
FreeResource
GetFileSize
GetFullPathNameW
GetLastError
CreateMutexW
LocalFree
SetEvent
OpenEventW
lstrcmpiW
GetCommandLineW
OutputDebugStringA
GetCommandLineA
FindNextFileW
OpenProcess
SetFileTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileTime
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetWindowsDirectoryW
SearchPathW
GetTempPathW

user32

wsprintfW
wvsprintfA
wvsprintfW
wsprintfA

advapi32

RegisterServiceCtrlHandlerExW
LookupAccountSidW
DuplicateToken
CreateWellKnownSid
CheckTokenMembership
IsWellKnownSid
GetTokenInformation
OpenProcessToken
EnumServicesStatusExW
QueryServiceConfigW
CreateServiceW
ChangeServiceConfig2W
RegSetValueW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
DeleteService
CloseServiceHandle
CryptGenRandom
SetServiceStatus
RegEnumValueW
RegDeleteValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExW
CryptAcquireContextW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW

shell32

ShellExecuteExW
SHChangeNotify
SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetFolderPathA

ole32

CoInitialize
CoCreateInstance
CoInitializeSecurity
CoUninitialize
IIDFromString
CoGetObject
CoInitializeEx

ntdll

NtQuerySystemTime
RtlDosPathNameToNtPathName_U
ZwDeleteFile
RtlFreeUnicodeString
RtlAcquirePebLock
RtlReleasePebLock
LdrEnumerateLoadedModules
ZwQueryInformationProcess
RtlTimeToSecondsSince1980
ZwSetInformationProcess

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2a45a55dd76530400b6ccc67f08677d7

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

shlwapi

crypt32

version

msvcrt

psapi

kernel32

user32

advapi32

shell32

ole32

ntdll

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 196KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 196KB

.rsrc
Size: 1KB - Virtual size: 1KB