Extracted

• • Target

    LB3.exe

  • Size

    147KB

  • MD5

    67008d6538e43ec4ef57359f7ca4f15f

  • SHA1

    65078b6e640146bde300af0a6d70b91f45244343

  • SHA256

    cb43fff6739186bdf2af5d4f34624c020196616cdae86fb755bf3d250bbe9b12

  • SHA512

    9a9e281dcf6a783cb69f6ab9703af716dd304883ad1a92a17bf4498745b563b2560e4624d839cc7577776d31e22f596d821a183c4c4ec350d7fa7a8f0e44db54

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepTN5GqoLVB5FHONF:V6gDBGpvEByocWeX/oZB7u/

  Score

  10^/10

  defense_evasiondiscoveryransomwarespywarestealer

  • Renames multiple (341) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2