2024-09-21_1c3cdb19078a5d571c0d3661ffd2ecfe_lockbit

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-21_1c3cdb19078a5d571c0d3661ffd2ecfe_lockbit
Size

274KB
MD5

1c3cdb19078a5d571c0d3661ffd2ecfe
SHA1

8f8916f8257928fbb6640322af0816a1d2c30a4f
SHA256

175c2398b979431586c48f0647e8d51c25ea70ec10bf3cd1143bc7b3db29d4c3
SHA512

1a4de260dc5f7bac9d57817d9fb27319ea07ccd34847ac07c513e019bccec7231949a8b2514c23d4bbae9a965625916b429b72a3f5debd6d57d291fd6ae65478
SSDEEP

6144:PGpV1z8QUGpGGpV1z8Qcy1PSbOqslVC7nJUkhIeMIcC16V:OpVaspPpVaxy0bOM7np+e31

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-21_1c3cdb19078a5d571c0d3661ffd2ecfe_lockbit

Files

2024-09-21_1c3cdb19078a5d571c0d3661ffd2ecfe_lockbit
.exe windows:5 windows x86 arch:x86

f5e4c8acb92fb1c8223cff431020dba0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
getsockname
shutdown
setsockopt
WSAConnect
closesocket
send
WSASocketW
WSAStartup
freeaddrinfo
getaddrinfo
WSAGetLastError
select
getpeername
recv

shlwapi

PathCombineW
wvnsprintfW
wvnsprintfA
PathFindFileNameW
PathRemoveFileSpecA
PathRemoveBackslashA
PathAddBackslashA
PathSkipRootW
PathMatchSpecW
PathUnquoteSpacesW
StrCmpNIW
StrStrIW

crypt32

CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

msvcrt

tolower
strncmp
sprintf
strtod
memcpy
_except_handler3
memset

psapi

GetProcessImageFileNameW

kernel32

UpdateResourceW
LockResource
BeginUpdateResourceW
SizeofResource
GetComputerNameW
GetNativeSystemInfo
CreateDirectoryW
GetModuleHandleW
GetCurrentThread
GetCommandLineA
GetComputerNameExW
lstrlenA
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
LoadLibraryExW
GetProcAddress
lstrlenW
WideCharToMultiByte
FreeLibrary
LoadLibraryW
lstrcpynW
lstrcatW
FindResourceW
LoadResource
ExitProcess
GetVolumeNameForVolumeMountPointA
GetTempFileNameW
CreateProcessW
MoveFileExW
WaitForSingleObject
GetTickCount
WriteFile
TerminateProcess
GetModuleFileNameW
CreateFileW
OpenMutexW
CreateEventW
CloseHandle
DeleteFileW
SetFileAttributesW
FindFirstFileW
GetSystemDirectoryW
Sleep
CopyFileW
GetFileAttributesW
FindClose
GetModuleHandleA
lstrcpyW
GetFullPathNameW
GetCommandLineW
GetFileSize
CreateMutexW
SetFilePointerEx
GetUserDefaultLCID
SetEvent
EndUpdateResourceW
ReadFile
GetLastError
SetCurrentDirectoryW
lstrcmpiW
OpenEventW
OutputDebugStringA
LocalFree
CreateThread
FindNextFileW
MapViewOfFile
UnmapViewOfFile
SetFileTime
OpenProcess
Process32FirstW
CreateFileMappingW
Process32NextW
CreateToolhelp32Snapshot
GetFileTime
GetCurrentProcess
GetWindowsDirectoryW
SearchPathW
GetTempPathW
EnumResourceNamesW
FreeResource
SetThreadPriority

user32

wvsprintfA
wvsprintfW
wsprintfW
wsprintfA

advapi32

RegDeleteValueW
CryptGenRandom
RegCreateKeyExW
CreateWellKnownSid
CheckTokenMembership
LookupAccountSidW
DuplicateToken
GetTokenInformation
IsWellKnownSid
OpenProcessToken
EnumServicesStatusExW
QueryServiceConfigW
SetServiceStatus
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
RegSetValueW
RegisterServiceCtrlHandlerExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegEnumValueW
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptGetHashParam

shell32

SHChangeNotify
ShellExecuteExW
SHGetFolderPathA
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW

ole32

CoUninitialize
CoGetObject
IIDFromString
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

ntdll

ZwQueryInformationProcess
ZwSetInformationProcess
RtlDosPathNameToNtPathName_U
ZwDeleteFile
RtlAcquirePebLock
RtlReleasePebLock
LdrEnumerateLoadedModules
RtlFreeUnicodeString

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DGNXMahl
Size: 512B - Virtual size: 148B

hBHaBPjL
Size: 13KB - Virtual size: 12KB

sbbZHmcO
Size: 31KB - Virtual size: 30KB

XdJPNSTC
Size: 512B - Virtual size: 486B

VqYQVZZY
Size: 2KB - Virtual size: 1KB

sIPMaxGa
Size: 512B - Virtual size: 395B

SjOTruvh
Size: 54KB - Virtual size: 54KB

WMfKmGzd
Size: 1KB - Virtual size: 1KB

OASdgAse
Size: 127KB - Virtual size: 127KB

ugpeaWvU
Size: 6KB - Virtual size: 5KB

Sharing

General

Malware Config

Signatures

Files

f5e4c8acb92fb1c8223cff431020dba0

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

shlwapi

crypt32

version

msvcrt

psapi

kernel32

user32

advapi32

shell32

ole32

ntdll

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 1024B - Virtual size: 196KB

.rsrc Size: 1024B - Virtual size: 1020B

DGNXMahl Size: 512B - Virtual size: 148B

hBHaBPjL Size: 13KB - Virtual size: 12KB

sbbZHmcO Size: 31KB - Virtual size: 30KB

XdJPNSTC Size: 512B - Virtual size: 486B

VqYQVZZY Size: 2KB - Virtual size: 1KB

sIPMaxGa Size: 512B - Virtual size: 395B

SjOTruvh Size: 54KB - Virtual size: 54KB

WMfKmGzd Size: 1KB - Virtual size: 1KB

OASdgAse Size: 127KB - Virtual size: 127KB

ugpeaWvU Size: 6KB - Virtual size: 5KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 1024B - Virtual size: 196KB

.rsrc
Size: 1024B - Virtual size: 1020B

DGNXMahl
Size: 512B - Virtual size: 148B

hBHaBPjL
Size: 13KB - Virtual size: 12KB

sbbZHmcO
Size: 31KB - Virtual size: 30KB

XdJPNSTC
Size: 512B - Virtual size: 486B

VqYQVZZY
Size: 2KB - Virtual size: 1KB

sIPMaxGa
Size: 512B - Virtual size: 395B

SjOTruvh
Size: 54KB - Virtual size: 54KB

WMfKmGzd
Size: 1KB - Virtual size: 1KB

OASdgAse
Size: 127KB - Virtual size: 127KB

ugpeaWvU
Size: 6KB - Virtual size: 5KB