Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_f018e2b0f1ca22198aaab119c78af25b_lockbit.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-13_f018e2b0f1ca22198aaab119c78af25b_lockbit.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-13_f018e2b0f1ca22198aaab119c78af25b_lockbit
-
Size
113KB
-
MD5
f018e2b0f1ca22198aaab119c78af25b
-
SHA1
39e5b12e5a1a606b6674b1d29ddd385877282bdd
-
SHA256
f9c7087bff99faedb979af23c711502c46c0899ec3299237c76b9e1efa48514f
-
SHA512
5ca081392c96abc4ff38ee36197171f074835c258884a6222063beea1914d00c62fe7977c2a0fa064dea27c7edaec4c76d0fdc0c36ef05a19e2b5235de59db79
-
SSDEEP
3072:nAxuW+dDvUuBSx40480b9q7nYniRrxVJ0NxylZVVAIf7GVVVrzpDWtbO/3Xb:ni47Uu04809q7nkiRrxKylZVVAIf7GV7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-13_f018e2b0f1ca22198aaab119c78af25b_lockbit
Files
-
2024-10-13_f018e2b0f1ca22198aaab119c78af25b_lockbit.exe windows:5 windows x86 arch:x86
fe6c43d7380fd0210d07e597791bf4c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
getsockname
shutdown
setsockopt
closesocket
send
WSAConnect
WSASocketW
WSAStartup
freeaddrinfo
WSAGetLastError
select
getpeername
getaddrinfo
recv
shlwapi
wvnsprintfW
wvnsprintfA
PathFindFileNameW
PathRemoveFileSpecA
PathRemoveBackslashA
PathAddBackslashA
PathSkipRootW
PathMatchSpecW
PathCombineW
PathUnquoteSpacesW
StrCmpNIW
StrStrIW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msvcrt
tolower
strncmp
sprintf
strtod
memcpy
_except_handler3
memset
kernel32
GetModuleHandleW
GetComputerNameW
CreateDirectoryW
GetNativeSystemInfo
GetFileTime
UpdateResourceW
GetComputerNameExW
GetLastError
lstrlenA
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
LoadLibraryExW
GetProcAddress
lstrlenW
WideCharToMultiByte
FreeLibrary
LoadLibraryW
lstrcpynW
lstrcatW
FindResourceW
LoadResource
ExitProcess
GetVolumeNameForVolumeMountPointA
GetTempFileNameW
CreateProcessW
MoveFileExW
WaitForSingleObject
GetTickCount
WriteFile
TerminateProcess
GetModuleFileNameW
CreateFileW
OpenMutexW
CreateEventW
CloseHandle
DeleteFileW
SetFileAttributesW
FindFirstFileW
GetSystemDirectoryW
Sleep
CopyFileW
GetFileAttributesW
FindClose
GetModuleHandleA
lstrcpyW
GetFullPathNameW
GetCommandLineW
GetFileSize
CreateMutexW
GetUserDefaultLCID
SetEvent
GetCommandLineA
ReadFile
LockResource
SetCurrentDirectoryW
lstrcmpiW
OpenEventW
OutputDebugStringA
LocalFree
CreateThread
FindNextFileW
GetCurrentProcess
GetWindowsDirectoryW
SearchPathW
GetTempPathW
EnumResourceNamesW
FreeResource
EndUpdateResourceW
SetFileTime
SizeofResource
BeginUpdateResourceW
user32
wsprintfA
wvsprintfA
wvsprintfW
wsprintfW
advapi32
CloseServiceHandle
CryptGenRandom
CreateWellKnownSid
CheckTokenMembership
LookupAccountSidW
DuplicateToken
GetTokenInformation
IsWellKnownSid
OpenProcessToken
EnumServicesStatusExW
QueryServiceConfigW
SetServiceStatus
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
RegisterServiceCtrlHandlerExW
OpenServiceW
OpenSCManagerW
DeleteService
CryptAcquireContextW
CreateServiceW
RegEnumValueW
RegDeleteValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteExW
SHGetFolderPathA
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHChangeNotify
ole32
CoUninitialize
CoGetObject
IIDFromString
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
ntdll
RtlDosPathNameToNtPathName_U
ZwDeleteFile
RtlAcquirePebLock
RtlReleasePebLock
LdrEnumerateLoadedModules
RtlFreeUnicodeString
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ