3968a850f5bc70d954bb5609d929f181a6f05a117fa3be4531cbd96cedfde5d6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FC8E43EC21BE9047/lbg64.exe
Size

49KB
MD5

8ff61e4156c10b085e0c2233f24e8501
SHA1

69d50a8efd73c619aa36113ec04368db83d9b331
SHA256

3552dda80bd6875c1ed1273ca7562c9ace3de2f757266dae70f60bf204089a4a
SHA512

dbde74b89d498d708215ddfdc9a2a38cb27be931c9fe2d5965aba3c31482a0efbe39913ed17eabe5eae3b5efc9cb369589784e7d9ce5b2e89505c10406038249
SSDEEP

768:9pZt6fz03gUYxTSGCoTrxTjA+xqCkEiAOPZAzEZoo6Czcit6OjeB6:jpQRNSGCo64OxAgZUCcicvB6

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
1448	lbg64.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Restore-My-Files.txt	lbg64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	lbg64.exe
File opened (read-only)	\??\U:	lbg64.exe
File opened (read-only)	\??\P:	lbg64.exe
File opened (read-only)	\??\G:	lbg64.exe
File opened (read-only)	\??\K:	lbg64.exe
File opened (read-only)	\??\X:	lbg64.exe
File opened (read-only)	\??\I:	lbg64.exe
File opened (read-only)	\??\A:	lbg64.exe
File opened (read-only)	\??\H:	lbg64.exe
File opened (read-only)	\??\V:	lbg64.exe
File opened (read-only)	\??\M:	lbg64.exe
File opened (read-only)	\??\D:	lbg64.exe
File opened (read-only)	\??\E:	lbg64.exe
File opened (read-only)	\??\S:	lbg64.exe
File opened (read-only)	\??\L:	lbg64.exe
File opened (read-only)	\??\Z:	lbg64.exe
File opened (read-only)	\??\N:	lbg64.exe
File opened (read-only)	\??\F:	lbg64.exe
File opened (read-only)	\??\T:	lbg64.exe
File opened (read-only)	\??\O:	lbg64.exe
File opened (read-only)	\??\J:	lbg64.exe
File opened (read-only)	\??\B:	lbg64.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt.b88c37ecea94	lbg64.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\PipelineSegments.store.a0cf6c545eac	lbg64.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\THMBNAIL.PNG.76ccb92a2cc2	lbg64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.5ec09d323cea	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\EVRGREEN.INF.e05ebdb4be6c	lbg64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ir.idl.94ff68080a60	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.199a80958f5d	lbg64.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\officemuiset.msi.16.en-us.vreg.dat.e97a90857f2d	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.5cdf80d0c298	lbg64.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.c84982a4ba0c	lbg64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ta.pak.DATA.9260f13e3066	lbg64.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.d6be6bc6cc1e	lbg64.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.25173177493f	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.b6a61326dc8e	lbg64.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Bold.otf.7389f9211359	lbg64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\show_third_party_software_licenses.bat.53afff414fb9	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\THMBNAIL.PNG.09f2f8a5afdd	lbg64.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt.c55a9c595b11	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.6e6a07061cae	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat.1dd2cc918329	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.b36ede23519b	lbg64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.dll.sig.ffad51ede7d5	lbg64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt.a946ec4d57a5	lbg64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt.d304d4c7b1ef	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.8be66e2b2943	lbg64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Cryptomining.DATA.f54dbbaba943	lbg64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Entities.DATA.2decc2c1d7e9	lbg64.exe
File created	C:\Program Files\MSBuild\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.bb338b393ff1	lbg64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\Restore-My-Files.txt	lbg64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Combine_R_RHP.aapp.a207a6d2c09a	lbg64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.0e2d20a2b44a	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE.2cebc4c0d2e8	lbg64.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\AddressBook.png.f6cb3eae9446	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.dbc31bb9bf71	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.a80ea5dcd6a4	lbg64.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der.16d1c49a9422	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.a8d77c4c76a4	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.a23a9b32c0ea	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat.f6d227beb446	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.222f0e52406a	lbg64.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msadcer.dll.mui.01aba9b3a54b	lbg64.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\info.gif.9875ee1c1a54	lbg64.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.cc35fae0d618	lbg64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.e0a3408c86d4	lbg64.exe
File created	C:\Program Files (x86)\Google\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.013d3f979d4f	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.f8966dbca6f4	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.d6d0055a5462	lbg64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.1d6b75b781ff	lbg64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\SmallLogoDev.png.DATA.358abc696b01	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.764b3e2e14c6	lbg64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.0c626da0b2f8	lbg64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.dba67efbf933	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms.e6a5408a8cd2	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.f357a7a1bf49	lbg64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\Restore-My-Files.txt	lbg64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.a151f34f45b7	lbg64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1448	lbg64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	lbg64.exe

C:\Users\Admin\AppData\Local\Temp\FC8E43EC21BE9047\lbg64.exe
"C:\Users\Admin\AppData\Local\Temp\FC8E43EC21BE9047\lbg64.exe"
1⤵
- Deletes itself
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\Restore-My-Files.txt

Filesize
6KB

MD5
74a77bd81fa83b32b595eafa20c978ec

SHA1
5ce7e2079a61d012d4839a84eb7bb329651a2ead

SHA256
49cc31e84e5f3cf75de5d5f58f62ac6c43d9dca726dfc750593129b730a56616

SHA512
71accd7c7e1060a696718a4f11a7e04c2f6c16b05dfe4fa12e80878d703a403b7d33861b1315436f881fba37e1a0c3ae2aefc09499f5e7b04b2c582ba0e635e4

Download Submit
memory/1448-9-0x00007FFF66120000-0x00007FFF662C1000-memory.dmp

Filesize
1.6MB

Download
memory/1448-10-0x00007FFF662D0000-0x00007FFF6633B000-memory.dmp

Filesize
428KB

Download
memory/1448-3-0x00007FFF641A0000-0x00007FFF64469000-memory.dmp

Filesize
2.8MB

Download
memory/1448-5-0x00007FFF63D60000-0x00007FFF63EB6000-memory.dmp

Filesize
1.3MB

Download
memory/1448-4-0x00007FFF65210000-0x00007FFF652BC000-memory.dmp

Filesize
688KB

Download
memory/1448-7-0x00007FFF64F90000-0x00007FFF6505D000-memory.dmp

Filesize
820KB

Download
memory/1448-2-0x00007FFF65B50000-0x00007FFF65C0E000-memory.dmp

Filesize
760KB

Download
memory/1448-0-0x00007FF65FD30000-0x00007FF65FE57000-memory.dmp

Filesize
1.2MB

Download
memory/1448-6-0x00007FFF652C0000-0x00007FFF653EA000-memory.dmp

Filesize
1.2MB

Download
memory/1448-8-0x00007FFF646C0000-0x00007FFF64DFF000-memory.dmp

Filesize
7.2MB

Download
memory/1448-1-0x00007FFF66610000-0x00007FFF66805000-memory.dmp

Filesize
2.0MB

Download
memory/1448-3881-0x00007FF65FD30000-0x00007FF65FE57000-memory.dmp

Filesize
1.2MB

Download
memory/1448-4261-0x00007FF65FD30000-0x00007FF65FE57000-memory.dmp

Filesize
1.2MB

Download
memory/1448-5467-0x00007FF65FD30000-0x00007FF65FE57000-memory.dmp

Filesize
1.2MB

Download
memory/1448-6746-0x00007FF65FD30000-0x00007FF65FE57000-memory.dmp

Filesize
1.2MB

Download