38a71ff442d943f02a32b4e909a7359b003d6c5872cc5f5dfa470fb0ece3d976

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockBit3 RansomWare/Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

pid	Process
2552	keygen.exe
2556	builder.exe
1516	builder.exe
1708	builder.exe
1988	builder.exe
2208	builder.exe
2440	builder.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2552	2304	cmd.exe	32
PID 2304 wrote to memory of 2552	2304	cmd.exe	32
PID 2304 wrote to memory of 2552	2304	cmd.exe	32
PID 2304 wrote to memory of 2552	2304	cmd.exe	32
PID 2304 wrote to memory of 2556	2304	cmd.exe	33
PID 2304 wrote to memory of 2556	2304	cmd.exe	33
PID 2304 wrote to memory of 2556	2304	cmd.exe	33
PID 2304 wrote to memory of 2556	2304	cmd.exe	33
PID 2304 wrote to memory of 1516	2304	cmd.exe	34
PID 2304 wrote to memory of 1516	2304	cmd.exe	34
PID 2304 wrote to memory of 1516	2304	cmd.exe	34
PID 2304 wrote to memory of 1516	2304	cmd.exe	34
PID 2304 wrote to memory of 1708	2304	cmd.exe	35
PID 2304 wrote to memory of 1708	2304	cmd.exe	35
PID 2304 wrote to memory of 1708	2304	cmd.exe	35
PID 2304 wrote to memory of 1708	2304	cmd.exe	35
PID 2304 wrote to memory of 1988	2304	cmd.exe	36
PID 2304 wrote to memory of 1988	2304	cmd.exe	36
PID 2304 wrote to memory of 1988	2304	cmd.exe	36
PID 2304 wrote to memory of 1988	2304	cmd.exe	36
PID 2304 wrote to memory of 2208	2304	cmd.exe	37
PID 2304 wrote to memory of 2208	2304	cmd.exe	37
PID 2304 wrote to memory of 2208	2304	cmd.exe	37
PID 2304 wrote to memory of 2208	2304	cmd.exe	37
PID 2304 wrote to memory of 2440	2304	cmd.exe	38
PID 2304 wrote to memory of 2440	2304	cmd.exe	38
PID 2304 wrote to memory of 2440	2304	cmd.exe	38
PID 2304 wrote to memory of 2440	2304	cmd.exe	38

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build -pubkey pub.key -privkey priv.key
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3Decryptor.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3_pass.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3_Rundll32.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1988
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3_Rundll32_pass.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2440

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads