2024-11-02_2afd9c21f68ec2b2607b7b0a80b84b47_lockbit

Sharing

Copy URL Twitter E-mail

General

Target
2024-11-02_2afd9c21f68ec2b2607b7b0a80b84b47_lockbit
Size 275KB
Sample241102-ymmm5stgrl
SHA256 bbe0c852bf7e9391da822df2c4fa6527152d0014dcd2855cefc5ec88f2d65f3e
MD5 2afd9c21f68ec2b2607b7b0a80b84b47
SHA1 dd39311e01457c5702329be243e8eee142bddbcb
SHA512 8fa6d7d26df7b681de4c4b11cdc5c4f60831d6bd7ea4e9f6c6dd8b8892441bce95bf8eae33e5f7f979147af68dc790957cb89771b7f3592e1fd3e37184ad6662
SSDEEP 6144:XGpV1z8QoGpGGpV1z8Qcy1PSbOqslVC7nJUkhIeMIcC16V:WpVaQpPpVaxy0bOM7np+e31
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-11-02_2afd9c21f68ec2b2607b7b0a80b84b47_lockbit

File Explorer

2024-11-02_2afd9c21f68ec2b2607b7b0a80b84b47_lockbit

.exe 275KB

2024-11-02_2afd9c21f68ec2b2607b7b0a80b84b47_lockbit

IMPHASH f5e4c8acb92fb1c8223cff431020dba0
SHA256 bbe0c852bf7e9391da822df2c4fa6527152d0014dcd2855cefc5ec88f2d65f3e
MD5 2afd9c21f68ec2b2607b7b0a80b84b47
SHA1 dd39311e01457c5702329be243e8eee142bddbcb
SHA512 8fa6d7d26df7b681de4c4b11cdc5c4f60831d6bd7ea4e9f6c6dd8b8892441bce95bf8eae33e5f7f979147af68dc790957cb89771b7f3592e1fd3e37184ad6662
SSDEEP 6144:XGpV1z8QoGpGGpV1z8Qcy1PSbOqslVC7nJUkhIeMIcC16V:WpVaQpPpVaxy0bOM7np+e31
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

htons getsockname shutdown setsockopt WSAConnect closesocket send WSASocketW WSAStartup freeaddrinfo getaddrinfo WSAGetLastError select getpeername recv

shlwapi

PathCombineW wvnsprintfW wvnsprintfA PathFindFileNameW PathRemoveFileSpecA PathRemoveBackslashA PathAddBackslashA PathSkipRootW PathMatchSpecW PathUnquoteSpacesW StrCmpNIW StrStrIW

crypt32

CryptMsgGetParam CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

msvcrt

tolower strncmp sprintf strtod memcpy _except_handler3 memset

psapi

GetProcessImageFileNameW

kernel32

UpdateResourceW LockResource BeginUpdateResourceW SizeofResource GetComputerNameW GetNativeSystemInfo CreateDirectoryW GetModuleHandleW GetCurrentThread GetCommandLineA GetComputerNameExW lstrlenA HeapReAlloc HeapAlloc HeapFree HeapCreate HeapValidate GetProcessHeaps HeapSetInformation GetCurrentProcessId LoadLibraryExW GetProcAddress lstrlenW WideCharToMultiByte FreeLibrary LoadLibraryW lstrcpynW lstrcatW FindResourceW LoadResource ExitProcess GetVolumeNameForVolumeMountPointA GetTempFileNameW CreateProcessW MoveFileExW WaitForSingleObject GetTickCount WriteFile TerminateProcess GetModuleFileNameW CreateFileW OpenMutexW CreateEventW CloseHandle DeleteFileW SetFileAttributesW FindFirstFileW GetSystemDirectoryW Sleep CopyFileW GetFileAttributesW FindClose GetModuleHandleA lstrcpyW GetFullPathNameW GetCommandLineW GetFileSize CreateMutexW SetFilePointerEx GetUserDefaultLCID SetEvent EndUpdateResourceW ReadFile GetLastError SetCurrentDirectoryW lstrcmpiW OpenEventW OutputDebugStringA LocalFree CreateThread FindNextFileW MapViewOfFile UnmapViewOfFile SetFileTime OpenProcess Process32FirstW CreateFileMappingW Process32NextW CreateToolhelp32Snapshot GetFileTime GetCurrentProcess GetWindowsDirectoryW SearchPathW GetTempPathW EnumResourceNamesW FreeResource SetThreadPriority

user32

wvsprintfA wvsprintfW wsprintfW wsprintfA

advapi32

RegDeleteValueW CryptGenRandom RegCreateKeyExW CreateWellKnownSid CheckTokenMembership LookupAccountSidW DuplicateToken GetTokenInformation IsWellKnownSid OpenProcessToken EnumServicesStatusExW QueryServiceConfigW SetServiceStatus QueryServiceStatus StartServiceW ChangeServiceConfig2W RegSetValueW RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle CreateServiceW RegEnumValueW CryptAcquireContextW SetSecurityDescriptorDacl InitializeSecurityDescriptor StartServiceCtrlDispatcherW CryptHashData CryptDestroyHash CryptCreateHash CryptReleaseContext RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW CryptGetHashParam

shell32

SHChangeNotify ShellExecuteExW SHGetFolderPathA SHGetFolderPathW SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoUninitialize CoGetObject IIDFromString CoInitialize CoInitializeEx CoInitializeSecurity CoCreateInstance

ntdll

ZwQueryInformationProcess ZwSetInformationProcess RtlDosPathNameToNtPathName_U ZwDeleteFile RtlAcquirePebLock RtlReleasePebLock LdrEnumerateLoadedModules RtlFreeUnicodeString

Name

.text

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

DGNXMahl

Size

512B

Virtual Size

148B

Characteristics

Name

hBHaBPjL

Size

13KB

Virtual Size

12KB

Characteristics

Name

sbbZHmcO

Size

31KB

Virtual Size

30KB

Characteristics

Name

XdJPNSTC

Size

512B

Virtual Size

486B

Characteristics

Name

VqYQVZZY

Size

2KB

Virtual Size

1KB

Characteristics

Name

sIPMaxGa

Size

512B

Virtual Size

395B

Characteristics

Name

SjOTruvh

Size

54KB

Virtual Size

54KB

Characteristics

Name

WMfKmGzd

Size

1KB

Virtual Size

1KB

Characteristics

Name

OASdgAse

Size

127KB

Virtual Size

127KB

Characteristics

Name

ugpeaWvU

Size

6KB

Virtual Size

5KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2024-11-02_2afd9c21f68ec2b2607b7b0a80b84b47_lockbit

ws2_32

shlwapi

crypt32

version

msvcrt

psapi

kernel32

user32

advapi32

shell32

ole32

ntdll

generic