Behavioral task
behavioral1
Sample
Lockbit2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Lockbit2.exe
Resource
win10v2004-20240802-en
General
-
Target
Lockbit2.exe
-
Size
143KB
-
MD5
d2725bca9cff007555bacf2ec998f453
-
SHA1
87b8918e94d44cab2ba113f5f9fba21279b4a8ef
-
SHA256
b49c2214a192f777060c812e5e9ac678d19919e8f21fe3e4ed62c85ecc9040e8
-
SHA512
8ad66283d073b9a53e4b80f0ba5795954920006e65d2774f47829620fee5f11f664c7d467b8a2f234c98a584b7d8206fee22b570dcb1610a695013d7d603bb25
-
SSDEEP
3072:4w2vENKK7DzwxJfkID9ek8c4RyJuq1DVedjqi7DKXIlu0NT8ZmDProa7W:wvzK7DaawkRyJH4djl7DKXIpKmDPkaK
Malware Config
Signatures
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
Processes:
resource yara_rule sample family_lockbit -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Lockbit2.exe
Files
-
Lockbit2.exe.exe windows:5 windows x86 arch:x86
914685b69f2ac2ff61b6b0f1883a054d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
SetPixel
GetPixel
SelectPalette
SelectObject
GetTextColor
BitBlt
GetDeviceCaps
CreateSolidBrush
CreateFontW
CreateDIBitmap
user32
LoadMenuW
LoadImageW
CreateDialogParamW
CreateWindowExW
DefWindowProcW
GetDlgItem
IsDlgButtonChecked
kernel32
GetLastError
GetProcAddress
GetModuleHandleA
GetLocaleInfoW
FreeLibrary
GetFileAttributesW
GetCommandLineW
GetCommandLineA
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.itext Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE