Static task
static1
Behavioral task
behavioral1
Sample
2024-09-09_d19d3e4ac58a2d4639137adf919863d1_lockbit.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-09_d19d3e4ac58a2d4639137adf919863d1_lockbit.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-09_d19d3e4ac58a2d4639137adf919863d1_lockbit
-
Size
55KB
-
MD5
d19d3e4ac58a2d4639137adf919863d1
-
SHA1
6ef033ef0765ab13c8fa883e35264a9c608c3c6f
-
SHA256
1396c36bd9947e858d503ec00dcf9cc329a1a142ba5091a03fd12cfa79144e3a
-
SHA512
04ea190abe50542cf66ddf49bb62eb872465bdb2b3d5989d07452ac18d2808e898366b1aaf451a6b1409916a918c1e388238fda302a2482a0d11f407ef30d389
-
SSDEEP
768:QFOj0Pkj5ModZ4h2wd8iGjqW7AnHvtMaWRBB5sx4PC74801wSmY8u07uKL74kJGQ:GHE5Mod2kwd8L4qa4Bax40480pWFE2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-09_d19d3e4ac58a2d4639137adf919863d1_lockbit
Files
-
2024-09-09_d19d3e4ac58a2d4639137adf919863d1_lockbit.exe windows:5 windows x86 arch:x86
fe6c43d7380fd0210d07e597791bf4c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
getsockname
shutdown
setsockopt
closesocket
send
WSAConnect
WSASocketW
WSAStartup
freeaddrinfo
WSAGetLastError
select
getpeername
getaddrinfo
recv
shlwapi
wvnsprintfW
wvnsprintfA
PathFindFileNameW
PathRemoveFileSpecA
PathRemoveBackslashA
PathAddBackslashA
PathSkipRootW
PathMatchSpecW
PathCombineW
PathUnquoteSpacesW
StrCmpNIW
StrStrIW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msvcrt
tolower
strncmp
sprintf
strtod
memcpy
_except_handler3
memset
kernel32
GetModuleHandleW
GetComputerNameW
CreateDirectoryW
GetNativeSystemInfo
GetFileTime
UpdateResourceW
GetComputerNameExW
GetLastError
lstrlenA
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
LoadLibraryExW
GetProcAddress
lstrlenW
WideCharToMultiByte
FreeLibrary
LoadLibraryW
lstrcpynW
lstrcatW
FindResourceW
LoadResource
ExitProcess
GetVolumeNameForVolumeMountPointA
GetTempFileNameW
CreateProcessW
MoveFileExW
WaitForSingleObject
GetTickCount
WriteFile
TerminateProcess
GetModuleFileNameW
CreateFileW
OpenMutexW
CreateEventW
CloseHandle
DeleteFileW
SetFileAttributesW
FindFirstFileW
GetSystemDirectoryW
Sleep
CopyFileW
GetFileAttributesW
FindClose
GetModuleHandleA
lstrcpyW
GetFullPathNameW
GetCommandLineW
GetFileSize
CreateMutexW
GetUserDefaultLCID
SetEvent
GetCommandLineA
ReadFile
LockResource
SetCurrentDirectoryW
lstrcmpiW
OpenEventW
OutputDebugStringA
LocalFree
CreateThread
FindNextFileW
GetCurrentProcess
GetWindowsDirectoryW
SearchPathW
GetTempPathW
EnumResourceNamesW
FreeResource
EndUpdateResourceW
SetFileTime
SizeofResource
BeginUpdateResourceW
user32
wsprintfA
wvsprintfA
wvsprintfW
wsprintfW
advapi32
CloseServiceHandle
CryptGenRandom
CreateWellKnownSid
CheckTokenMembership
LookupAccountSidW
DuplicateToken
GetTokenInformation
IsWellKnownSid
OpenProcessToken
EnumServicesStatusExW
QueryServiceConfigW
SetServiceStatus
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
RegisterServiceCtrlHandlerExW
OpenServiceW
OpenSCManagerW
DeleteService
CryptAcquireContextW
CreateServiceW
RegEnumValueW
RegDeleteValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteExW
SHGetFolderPathA
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHChangeNotify
ole32
CoUninitialize
CoGetObject
IIDFromString
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
ntdll
RtlDosPathNameToNtPathName_U
ZwDeleteFile
RtlAcquirePebLock
RtlReleasePebLock
LdrEnumerateLoadedModules
RtlFreeUnicodeString
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ