lockbit | 82d89a75d80e80e4be42c9eb79e401558c9fa3175648cd0c0467f2de1a07a908

General

Target

82d89a75d80e80e4be42c9eb79e401558c9fa3175648cd0c0467f2de1a07a908.ps1
Size

590KB
MD5

d96d2bcf13d55740f3bb64d45d2db94d
SHA1

4ded4b1d4866a4adf534f5a4eb66386465fe3120
SHA256

82d89a75d80e80e4be42c9eb79e401558c9fa3175648cd0c0467f2de1a07a908
SHA512

cb1fbe8f36630915796d864c5a044177ea4ad881281ec454f932232fff99ce0524fb63becd96581a23cfe12bc455d55b613aaa389aa0a68fac97748400f473bd
SSDEEP

1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJh:QA

Score

10^/10

lockbit discovery execution ransomware

Malware Config

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
behavioral1/memory/2756-13-0x0000000010000000-0x0000000010022000-memory.dmp	family_lockbit

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2240	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2240	powershell.exe
2240	powershell.exe
2240	powershell.exe
2756	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2756	2240	powershell.exe	32
PID 2240 wrote to memory of 2756	2240	powershell.exe	32
PID 2240 wrote to memory of 2756	2240	powershell.exe	32
PID 2240 wrote to memory of 2756	2240	powershell.exe	32
PID 2756 wrote to memory of 2932	2756	powershell.exe	34
PID 2756 wrote to memory of 2932	2756	powershell.exe	34
PID 2756 wrote to memory of 2932	2756	powershell.exe	34
PID 2756 wrote to memory of 2932	2756	powershell.exe	34

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\82d89a75d80e80e4be42c9eb79e401558c9fa3175648cd0c0467f2de1a07a908.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\82d89a75d80e80e4be42c9eb79e401558c9fa3175648cd0c0467f2de1a07a908.ps1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "2756" "860"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259462436.txt

Filesize
1KB

MD5
1cbc4c2d57eb23bc32d96e2797c996ba

SHA1
af4cd2f8d9763b876d61a1d6029663a51ca960f4

SHA256
58b337872f9b0734c880f7e263ca281300e93337d8a24816fb6ca023e6f3b407

SHA512
5656fa31a754e87d23095c368bce966db9a9afe917ecf6ef34392e2b25d7d4325bcb58a1186672ae1430de9f73228e07da1448b50b9473d3ed76e2c340af0bff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DZBMSJN63S9V4E032FMN.temp

Filesize
7KB

MD5
22b99b9b211206e3656d6d7dabfaf744

SHA1
a1050232fe7322f45fa9d7115c79be58aab07334

SHA256
7670096e34c031da64602eb5537e36b1cf920d0e2664f515e215766d0f1eb373

SHA512
c47a58254d54830a92d24ad8fc712aeb1bce15c0493daa0887f4f1f79ef6d755d8f39ad45555201ded7d8f859751365cc69424d1e6f55d45f283543480f59131

Download Submit
memory/2240-4-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/2240-5-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/2240-6-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download
memory/2240-8-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/2240-7-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2240-9-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/2240-10-0x00000000777A0000-0x0000000077949000-memory.dmp

Filesize
1.7MB

Download
memory/2756-13-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing