Static task
static1
Behavioral task
behavioral1
Sample
2024-09-25_e6a3c4e5384688911180306d266abc0d_lockbit.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-25_e6a3c4e5384688911180306d266abc0d_lockbit.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-25_e6a3c4e5384688911180306d266abc0d_lockbit
-
Size
37KB
-
MD5
e6a3c4e5384688911180306d266abc0d
-
SHA1
cf82055ac030417416b98eed2d09499e80824fa7
-
SHA256
21fc9d40d7ff60cd4bef88b64ebd78cf53cf23ff9e5a2b4e64cbf4d8116e7e8f
-
SHA512
a9d18208538d9340b2ea1a22858e52773c9a70740cd661e222c146d43052001ad02b636c89a5ebfcd8febea3dd704301aa85173967039218e6c179d40b75c5e9
-
SSDEEP
768:GlKan8kr2D6AKlLO+SNhBgCHDck4MV0ggv8KoETBB9D3xvjHhx4eC7Xj8Qc1x:q8/6A0q5HDR4oWBx3xrBx41z8Qcj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-25_e6a3c4e5384688911180306d266abc0d_lockbit
Files
-
2024-09-25_e6a3c4e5384688911180306d266abc0d_lockbit.exe windows:5 windows x86 arch:x86
f5e4c8acb92fb1c8223cff431020dba0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
getsockname
shutdown
setsockopt
WSAConnect
closesocket
send
WSASocketW
WSAStartup
freeaddrinfo
getaddrinfo
WSAGetLastError
select
getpeername
recv
shlwapi
PathCombineW
wvnsprintfW
wvnsprintfA
PathFindFileNameW
PathRemoveFileSpecA
PathRemoveBackslashA
PathAddBackslashA
PathSkipRootW
PathMatchSpecW
PathUnquoteSpacesW
StrCmpNIW
StrStrIW
crypt32
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msvcrt
tolower
strncmp
sprintf
strtod
memcpy
_except_handler3
memset
psapi
GetProcessImageFileNameW
kernel32
UpdateResourceW
LockResource
BeginUpdateResourceW
SizeofResource
GetComputerNameW
GetNativeSystemInfo
CreateDirectoryW
GetModuleHandleW
GetCurrentThread
GetCommandLineA
GetComputerNameExW
lstrlenA
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
LoadLibraryExW
GetProcAddress
lstrlenW
WideCharToMultiByte
FreeLibrary
LoadLibraryW
lstrcpynW
lstrcatW
FindResourceW
LoadResource
ExitProcess
GetVolumeNameForVolumeMountPointA
GetTempFileNameW
CreateProcessW
MoveFileExW
WaitForSingleObject
GetTickCount
WriteFile
TerminateProcess
GetModuleFileNameW
CreateFileW
OpenMutexW
CreateEventW
CloseHandle
DeleteFileW
SetFileAttributesW
FindFirstFileW
GetSystemDirectoryW
Sleep
CopyFileW
GetFileAttributesW
FindClose
GetModuleHandleA
lstrcpyW
GetFullPathNameW
GetCommandLineW
GetFileSize
CreateMutexW
SetFilePointerEx
GetUserDefaultLCID
SetEvent
EndUpdateResourceW
ReadFile
GetLastError
SetCurrentDirectoryW
lstrcmpiW
OpenEventW
OutputDebugStringA
LocalFree
CreateThread
FindNextFileW
MapViewOfFile
UnmapViewOfFile
SetFileTime
OpenProcess
Process32FirstW
CreateFileMappingW
Process32NextW
CreateToolhelp32Snapshot
GetFileTime
GetCurrentProcess
GetWindowsDirectoryW
SearchPathW
GetTempPathW
EnumResourceNamesW
FreeResource
SetThreadPriority
user32
wvsprintfA
wvsprintfW
wsprintfW
wsprintfA
advapi32
RegDeleteValueW
CryptGenRandom
RegCreateKeyExW
CreateWellKnownSid
CheckTokenMembership
LookupAccountSidW
DuplicateToken
GetTokenInformation
IsWellKnownSid
OpenProcessToken
EnumServicesStatusExW
QueryServiceConfigW
SetServiceStatus
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
RegSetValueW
RegisterServiceCtrlHandlerExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegEnumValueW
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptGetHashParam
shell32
SHChangeNotify
ShellExecuteExW
SHGetFolderPathA
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
ole32
CoUninitialize
CoGetObject
IIDFromString
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
ntdll
ZwQueryInformationProcess
ZwSetInformationProcess
RtlDosPathNameToNtPathName_U
ZwDeleteFile
RtlAcquirePebLock
RtlReleasePebLock
LdrEnumerateLoadedModules
RtlFreeUnicodeString
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ