Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-11-2024 01:10
General
-
Target
ransom/Build/LB3Decryptor.exe
-
Size
54KB
-
MD5
333ac98a465013153ef64a13fe03b474
-
SHA1
94e92e86759b9609542264e81f826f64efc5fcfd
-
SHA256
f786bc48b6aa6486e9b13b64475379b3a7699fcc877ad6c41f5de3cc7d7196d8
-
SHA512
427854c59772308c9f18d8f070607ca6bb691507647f348aeece1c6aae3d8beab60ef91623120242d3ae4bf477ee4add0076ee4a6465fb789a2ba67187501703
-
SSDEEP
768:vlD2N5KCJD5rkdDRib1Xf0854gC3E9zpKMMYj1MYgFMRx:VAkCJD5rKDRib1F54gLp2Yj1M7MD
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3Decryptor.exe"C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3Decryptor.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken