Analysis

  • max time kernel
    102s
  • max time network
    124s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    20-12-2024 00:56

General

  • Target

    FC8E43EC21BE9047/lbg64.exe

  • Size

    49KB

  • MD5

    8ff61e4156c10b085e0c2233f24e8501

  • SHA1

    69d50a8efd73c619aa36113ec04368db83d9b331

  • SHA256

    3552dda80bd6875c1ed1273ca7562c9ace3de2f757266dae70f60bf204089a4a

  • SHA512

    dbde74b89d498d708215ddfdc9a2a38cb27be931c9fe2d5965aba3c31482a0efbe39913ed17eabe5eae3b5efc9cb369589784e7d9ce5b2e89505c10406038249

  • SSDEEP

    768:9pZt6fz03gUYxTSGCoTrxTjA+xqCkEiAOPZAzEZoo6Czcit6OjeB6:jpQRNSGCo64OxAgZUCcicvB6

Malware Config

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FC8E43EC21BE9047\lbg64.exe
    "C:\Users\Admin\AppData\Local\Temp\FC8E43EC21BE9047\lbg64.exe"
    1⤵
    • Deletes itself
    • Drops startup file
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:1092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Device\HarddiskVolume1\Restore-My-Files.txt

    Filesize

    6KB

    MD5

    74a77bd81fa83b32b595eafa20c978ec

    SHA1

    5ce7e2079a61d012d4839a84eb7bb329651a2ead

    SHA256

    49cc31e84e5f3cf75de5d5f58f62ac6c43d9dca726dfc750593129b730a56616

    SHA512

    71accd7c7e1060a696718a4f11a7e04c2f6c16b05dfe4fa12e80878d703a403b7d33861b1315436f881fba37e1a0c3ae2aefc09499f5e7b04b2c582ba0e635e4

  • memory/1092-8-0x00007FFEE8670000-0x00007FFEE8DDC000-memory.dmp

    Filesize

    7.4MB

  • memory/1092-10-0x00007FFEE8DE0000-0x00007FFEE8E4B000-memory.dmp

    Filesize

    428KB

  • memory/1092-3-0x00007FFEE76C0000-0x00007FFEE79B6000-memory.dmp

    Filesize

    3.0MB

  • memory/1092-4-0x00007FFEE8460000-0x00007FFEE8510000-memory.dmp

    Filesize

    704KB

  • memory/1092-5-0x00007FFEE74D0000-0x00007FFEE762E000-memory.dmp

    Filesize

    1.4MB

  • memory/1092-6-0x00007FFEE8540000-0x00007FFEE866B000-memory.dmp

    Filesize

    1.2MB

  • memory/1092-2-0x00007FFEE9760000-0x00007FFEE981D000-memory.dmp

    Filesize

    756KB

  • memory/1092-0-0x00007FF68F8F0000-0x00007FF68FA17000-memory.dmp

    Filesize

    1.2MB

  • memory/1092-7-0x00007FFEE9A00000-0x00007FFEE9ACD000-memory.dmp

    Filesize

    820KB

  • memory/1092-9-0x00007FFEE82C0000-0x00007FFEE845F000-memory.dmp

    Filesize

    1.6MB

  • memory/1092-1-0x00007FFEE9D30000-0x00007FFEE9F28000-memory.dmp

    Filesize

    2.0MB

  • memory/1092-3968-0x00007FF68F8F0000-0x00007FF68FA17000-memory.dmp

    Filesize

    1.2MB

  • memory/1092-3950-0x00007FF68F8F0000-0x00007FF68FA17000-memory.dmp

    Filesize

    1.2MB

  • memory/1092-5551-0x00007FF68F8F0000-0x00007FF68FA17000-memory.dmp

    Filesize

    1.2MB

  • memory/1092-7322-0x00007FF68F8F0000-0x00007FF68FA17000-memory.dmp

    Filesize

    1.2MB