Overview

overview

8

Static

static

1

2024-12-27...ockbit

ubuntu-22.04-amd64

8

Resubmissions

28/03/2025, 06:04

250328-gsw1bsswcx 8

27/12/2024, 01:42

241227-b4yqeaylan 8

Analysis

  • max time kernel
    6s
  • max time network
    131s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    27/12/2024, 01:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-27_3589e9b7abdf6e89063977847351173b_lockbit

  • Size

    89KB

  • MD5

    3589e9b7abdf6e89063977847351173b

  • SHA1

    a95652971f89587cf5f717c99c894ca2122101a0

  • SHA256

    f9b34255399925fcae10f34e78275446f9a90263afd3b825e889d5e631a74d0e

  • SHA512

    90550b2e8e9ddabbccf5d35907d40282db65876da1efb6e0e864ec8e8e8e1a92f2da0082b64d286f8c05087f417caa2470da1bc89f8ad55e8bd168305c7e2155

  • SSDEEP

    1536:h23bmHSlAhb6eo1xrac08UGNnPnEsT9VxU+tqRAsemhgYBzvI:4rmHSlAhbx+K8UUnPEsBVxDtqR19gAI

Score
8/10
antivmdiscovery

Malware Config

Signatures

  • Traces remote process 1 IoCs
  • Reads AppArmor ptrace settings 1 TTPs 1 IoCs

    Discovery of allowed ptrace capabilities by AppArmor.

    discovery
  • Checks system information (zLinux) 1 TTPs 1 IoCs

    Check system information on IBM zSystems which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

    discovery
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/2024-12-27_3589e9b7abdf6e89063977847351173b_lockbit
    /tmp/2024-12-27_3589e9b7abdf6e89063977847351173b_lockbit
    1⤵
    • Traces remote process
    • Reads AppArmor ptrace settings
    • Reads hardware information
    • Reads network interface configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1596
    • /bin/sh
      sh -c "vim-cmd hostsvc/hostsummary | grep cpuModel | cut -d '\"' -f2"
      2⤵
        PID:1597
        • /usr/bin/cut
          cut -d "\"" -f2
          3⤵
            PID:1600
          • /usr/bin/grep
            grep cpuModel
            3⤵
              PID:1599
          • /bin/sh
            sh -c "lscpu | grep \"Model name\" | cut -d ':' -f2"
            2⤵
              PID:1601
              • /usr/bin/cut
                cut -d : -f2
                3⤵
                  PID:1604
                • /usr/bin/grep
                  grep "Model name"
                  3⤵
                    PID:1603
                  • /usr/bin/lscpu
                    lscpu
                    3⤵
                    • Checks system information (zLinux)
                    • Checks CPU configuration
                    • Reads CPU attributes
                    PID:1602
                • /bin/sh
                  sh -c "esxcli storage filesystem list | tail -n +3"
                  2⤵
                    PID:1605
                    • /usr/bin/tail
                      tail -n +3
                      3⤵
                        PID:1607
                    • /bin/sh
                      sh -c "lsblk -io KNAME,TYPE,SIZE,MODEL | tail -n +2"
                      2⤵
                        PID:1608
                        • /usr/bin/tail
                          tail -n +2
                          3⤵
                            PID:1610
                          • /usr/bin/lsblk
                            lsblk -io "KNAME,TYPE,SIZE,MODEL"
                            3⤵
                            • Enumerates kernel/hardware configuration
                            PID:1609
                        • /bin/sh
                          sh -c "uname -a"
                          2⤵
                            PID:1611
                            • /usr/bin/uname
                              uname -a
                              3⤵
                                PID:1612
                            • /bin/sh
                              sh -c "vmware -v"
                              2⤵
                                PID:1613
                              • /bin/sh
                                sh -c "ls -alR /vmfs/"
                                2⤵
                                  PID:1633
                                  • /usr/bin/ls
                                    ls -alR /vmfs/
                                    3⤵
                                      PID:1634
                                  • /bin/sh
                                    sh -c "ps auxf"
                                    2⤵
                                      PID:1635
                                      • /usr/bin/ps
                                        ps auxf
                                        3⤵
                                        • Reads CPU attributes
                                        • Reads runtime system information
                                        PID:1636

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads