Extracted

• • Target

    69d0a3e0498fa0f11d88f0ede6a95635e319db742ad8ece64934a80a6ef525a6N

  • Size

    9.5MB

  • MD5

    d62e0db3e0ad4755edae9741328c24c0

  • SHA1

    a5b5b1b5f4df91a23d1809f02881dc4663683d3f

  • SHA256

    69d0a3e0498fa0f11d88f0ede6a95635e319db742ad8ece64934a80a6ef525a6

  • SHA512

    2cb1d62fa77afd58a632a9b7988fdfe52578f92b2132aa93d8ab6685009d1ac9ad4d42629c5ad59b8db812f3386babf8129e4ce378de0d937402a83ed2630113

  • SSDEEP

    196608:AimE4n6CwYR0Xcr7PnILLZWdoCOid3tlKXeXWnA7bxIzGrPp/ythn:4E46CwYqXcr7M5li/lKPA7bxIEZY

  Score

  10^/10

  defense_evasiondiscoveryransomwarespywarestealerlockbit

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • Renames multiple (315) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2