38a71ff442d943f02a32b4e909a7359b003d6c5872cc5f5dfa470fb0ece3d976

Resubmissions

25/03/2025, 13:29

250325-qrkekswyh1 10

05/02/2025, 11:20

250205-nfn8aawjbj 10

08/07/2024, 19:32

240708-x88l3axelh 10

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockBit3 RansomWare/Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

pid	Process
2544	keygen.exe
1704	builder.exe
2844	builder.exe
580	builder.exe
2224	builder.exe
2028	builder.exe
2348	builder.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2544	2604	cmd.exe	30
PID 2604 wrote to memory of 2544	2604	cmd.exe	30
PID 2604 wrote to memory of 2544	2604	cmd.exe	30
PID 2604 wrote to memory of 2544	2604	cmd.exe	30
PID 2604 wrote to memory of 1704	2604	cmd.exe	31
PID 2604 wrote to memory of 1704	2604	cmd.exe	31
PID 2604 wrote to memory of 1704	2604	cmd.exe	31
PID 2604 wrote to memory of 1704	2604	cmd.exe	31
PID 2604 wrote to memory of 2844	2604	cmd.exe	32
PID 2604 wrote to memory of 2844	2604	cmd.exe	32
PID 2604 wrote to memory of 2844	2604	cmd.exe	32
PID 2604 wrote to memory of 2844	2604	cmd.exe	32
PID 2604 wrote to memory of 580	2604	cmd.exe	33
PID 2604 wrote to memory of 580	2604	cmd.exe	33
PID 2604 wrote to memory of 580	2604	cmd.exe	33
PID 2604 wrote to memory of 580	2604	cmd.exe	33
PID 2604 wrote to memory of 2224	2604	cmd.exe	34
PID 2604 wrote to memory of 2224	2604	cmd.exe	34
PID 2604 wrote to memory of 2224	2604	cmd.exe	34
PID 2604 wrote to memory of 2224	2604	cmd.exe	34
PID 2604 wrote to memory of 2028	2604	cmd.exe	35
PID 2604 wrote to memory of 2028	2604	cmd.exe	35
PID 2604 wrote to memory of 2028	2604	cmd.exe	35
PID 2604 wrote to memory of 2028	2604	cmd.exe	35
PID 2604 wrote to memory of 2348	2604	cmd.exe	36
PID 2604 wrote to memory of 2348	2604	cmd.exe	36
PID 2604 wrote to memory of 2348	2604	cmd.exe	36
PID 2604 wrote to memory of 2348	2604	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build.bat" bcdedit /set delete /r /f /t 2
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build -pubkey pub.key -privkey priv.key
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3Decryptor.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1704
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3_pass.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:580
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3_Rundll32.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3_Rundll32_pass.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit3 RansomWare\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2348

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads