2024-10-10_3b4d2de3486ad5b03071e8d70ce8da01_lockbit

Sharing

Copy URL

Twitter E-mail

General

Target

2024-10-10_3b4d2de3486ad5b03071e8d70ce8da01_lockbit
Size

84KB
MD5

3b4d2de3486ad5b03071e8d70ce8da01
SHA1

3919462313d2b18ace72ca6589770fb839199f10
SHA256

f6a03a9d68e26460cc21634b35ce85f075b149a28fbcf1545cb81700bdd166e6
SHA512

5da6d3a181e800cbf4eee3879398f6cd2f3fc27a0239ccefd4e54c9401690f85ad63a2c8247f55b75f0883d96c09e478a5f7345170a5aa220d73c8e45540828d
SSDEEP

1536:PgxAxuW2ldyYvhauBSx40480jAbeHZrQKfAx:mAxuW+dDvUuBSx40480AeHdn4x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-10_3b4d2de3486ad5b03071e8d70ce8da01_lockbit

Files

2024-10-10_3b4d2de3486ad5b03071e8d70ce8da01_lockbit
.exe windows:5 windows x86 arch:x86

fe6c43d7380fd0210d07e597791bf4c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
getsockname
shutdown
setsockopt
closesocket
send
WSAConnect
WSASocketW
WSAStartup
freeaddrinfo
WSAGetLastError
select
getpeername
getaddrinfo
recv

shlwapi

wvnsprintfW
wvnsprintfA
PathFindFileNameW
PathRemoveFileSpecA
PathRemoveBackslashA
PathAddBackslashA
PathSkipRootW
PathMatchSpecW
PathCombineW
PathUnquoteSpacesW
StrCmpNIW
StrStrIW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

msvcrt

tolower
strncmp
sprintf
strtod
memcpy
_except_handler3
memset

kernel32

GetModuleHandleW
GetComputerNameW
CreateDirectoryW
GetNativeSystemInfo
GetFileTime
UpdateResourceW
GetComputerNameExW
GetLastError
lstrlenA
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
LoadLibraryExW
GetProcAddress
lstrlenW
WideCharToMultiByte
FreeLibrary
LoadLibraryW
lstrcpynW
lstrcatW
FindResourceW
LoadResource
ExitProcess
GetVolumeNameForVolumeMountPointA
GetTempFileNameW
CreateProcessW
MoveFileExW
WaitForSingleObject
GetTickCount
WriteFile
TerminateProcess
GetModuleFileNameW
CreateFileW
OpenMutexW
CreateEventW
CloseHandle
DeleteFileW
SetFileAttributesW
FindFirstFileW
GetSystemDirectoryW
Sleep
CopyFileW
GetFileAttributesW
FindClose
GetModuleHandleA
lstrcpyW
GetFullPathNameW
GetCommandLineW
GetFileSize
CreateMutexW
GetUserDefaultLCID
SetEvent
GetCommandLineA
ReadFile
LockResource
SetCurrentDirectoryW
lstrcmpiW
OpenEventW
OutputDebugStringA
LocalFree
CreateThread
FindNextFileW
GetCurrentProcess
GetWindowsDirectoryW
SearchPathW
GetTempPathW
EnumResourceNamesW
FreeResource
EndUpdateResourceW
SetFileTime
SizeofResource
BeginUpdateResourceW

user32

wsprintfA
wvsprintfA
wvsprintfW
wsprintfW

advapi32

CloseServiceHandle
CryptGenRandom
CreateWellKnownSid
CheckTokenMembership
LookupAccountSidW
DuplicateToken
GetTokenInformation
IsWellKnownSid
OpenProcessToken
EnumServicesStatusExW
QueryServiceConfigW
SetServiceStatus
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
RegisterServiceCtrlHandlerExW
OpenServiceW
OpenSCManagerW
DeleteService
CryptAcquireContextW
CreateServiceW
RegEnumValueW
RegDeleteValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteExW
SHGetFolderPathA
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHChangeNotify

ole32

CoUninitialize
CoGetObject
IIDFromString
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

ntdll

RtlDosPathNameToNtPathName_U
ZwDeleteFile
RtlAcquirePebLock
RtlReleasePebLock
LdrEnumerateLoadedModules
RtlFreeUnicodeString

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe6c43d7380fd0210d07e597791bf4c0

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

shlwapi

version

msvcrt

kernel32

user32

advapi32

shell32

ole32

ntdll

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 1024B - Virtual size: 193KB

.rsrc Size: 53KB - Virtual size: 53KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 193KB

.rsrc
Size: 53KB - Virtual size: 53KB