Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 14:48
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20241007-en
General
-
Target
LB3.exe
-
Size
153KB
-
MD5
194a2b32336037e01cee90666d88612e
-
SHA1
19bbb1fd707c9656e3781a78b0780f639395044a
-
SHA256
e1275c80d30a307899029cf13e3a190df717c3b7e68877e03650cebc07e418cf
-
SHA512
8656d21e2705967d310d19d9e2471f127138a1e709bf8c84d21096d5affdead0eab389c4cb7c4a1b0a249205cfa717ffe108725e00fc8cb192c6f36687ae2efd
-
SSDEEP
3072:x6glyuxE4GsUPnliByocWepwamici0p1zj/:x6gDBGpvEByocWehm3xD
Malware Config
Extracted
C:\Ox7PjiunT.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1496 F2D7.tmp -
Executes dropped EXE 1 IoCs
pid Process 1496 F2D7.tmp -
Loads dropped DLL 1 IoCs
pid Process 2016 LB3.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini LB3.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Ox7PjiunT.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Ox7PjiunT.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 1496 F2D7.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LB3.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ox7PjiunT LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ox7PjiunT\DefaultIcon\ = "C:\\ProgramData\\Ox7PjiunT.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Ox7PjiunT LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Ox7PjiunT\ = "Ox7PjiunT" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ox7PjiunT\DefaultIcon LB3.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe 2016 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp 1496 F2D7.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeDebugPrivilege 2016 LB3.exe Token: 36 2016 LB3.exe Token: SeImpersonatePrivilege 2016 LB3.exe Token: SeIncBasePriorityPrivilege 2016 LB3.exe Token: SeIncreaseQuotaPrivilege 2016 LB3.exe Token: 33 2016 LB3.exe Token: SeManageVolumePrivilege 2016 LB3.exe Token: SeProfSingleProcessPrivilege 2016 LB3.exe Token: SeRestorePrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSystemProfilePrivilege 2016 LB3.exe Token: SeTakeOwnershipPrivilege 2016 LB3.exe Token: SeShutdownPrivilege 2016 LB3.exe Token: SeDebugPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeBackupPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe Token: SeSecurityPrivilege 2016 LB3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1496 2016 LB3.exe 33 PID 2016 wrote to memory of 1496 2016 LB3.exe 33 PID 2016 wrote to memory of 1496 2016 LB3.exe 33 PID 2016 wrote to memory of 1496 2016 LB3.exe 33 PID 2016 wrote to memory of 1496 2016 LB3.exe 33 PID 1496 wrote to memory of 3032 1496 F2D7.tmp 34 PID 1496 wrote to memory of 3032 1496 F2D7.tmp 34 PID 1496 wrote to memory of 3032 1496 F2D7.tmp 34 PID 1496 wrote to memory of 3032 1496 F2D7.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\ProgramData\F2D7.tmp"C:\ProgramData\F2D7.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F2D7.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:3032
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5c86975d569c04b7af3dd7f8339d82c92
SHA1a5726c4509bb9dc4876608c705fb24d34b49ac70
SHA25662fa6ee1fe0b3af9a45e0128927d850f44de405e9eff801a86d462890bd82215
SHA5122cbb48a516e180f228d9797f0f17bd1f86ffe4966a1728457f5f854be2aaf2522f893ad8b721b4f5d83c5c5100a0f1a501c667d7b989788a856c2927bebadade
-
Filesize
6KB
MD5d1d23f8e3512d43890566ffddf568dd3
SHA1e1be39eba3cc63eec5e03330c1e9457dabb7e05b
SHA256258d301c081b78d4d1cf1a4816d9dd7ff48b8e1a00ca6902bc688258bd600b0f
SHA512fd6eea1d25199daf8edbeddcf37c56040812156b2fbbcf0a565bf0e4b82243365444b643c1ff6dab57aecb531a43bb573e360c5fe7e804d6129ca6a8674bab74
-
Filesize
153KB
MD5093581d0dd77d98c6a5157cb50202b86
SHA1273f48dd81c5f2fdeea45e47cdba2f93af2aa94f
SHA2561277981527944404795f4a901499b416a71ced42361c5b4caebe34729ed8ec0d
SHA512f460d3f9c7695e44072a0168a88eebb1a9ceb39619680b7da227d052ef4737b153749713c5a6d683553a25a7cf71ee5097a6a04fa3eba00e1d514fcce0975794
-
Filesize
129B
MD515de7415e8868663f10e391069b8bccd
SHA1a8d317a3c7a21e4c77c968d702d8a55a79d608d4
SHA2564f6b23530a0e7a35eed7002dc5d2228f09517248593633b26df2ac3f60875766
SHA512ee002ef02dd08d7821342433d6dac430b0356a84b3a8f2843508b920ddc5c75a7666d28d61c582391457970bc23cf5c0c78300ffa7d4b2a2528342614d71fa58
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf