34ae59b7acc09c2e82625640cae82c5158b649db1418ddbaa24138b51f1722c5

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockBit-Black-Builder-main/LockBit30/Build.bat
Size

733B
MD5

1905cc9973206fea5050b737f9303fb4
SHA1

497524177d9478a4b5dca3e73cc230be6abf4ce0
SHA256

e2f5b93040d57de6251d16256bcd04aa8eb337bde87308e602f01070efd345fb
SHA512

95bae9406d01083f6fe6916ecf8e889afe20ff5863070f1787dc7a60d2d1d5af2cf3fd481a3c4fb531f16dd2cb7a685002aaac1dc907cf189c19c60f2816dd76

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

pid	Process
2828	keygen.exe
2896	builder.exe
2772	builder.exe
3008	builder.exe
2196	builder.exe
2864	builder.exe
2736	builder.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2828	2728	cmd.exe	31
PID 2728 wrote to memory of 2828	2728	cmd.exe	31
PID 2728 wrote to memory of 2828	2728	cmd.exe	31
PID 2728 wrote to memory of 2828	2728	cmd.exe	31
PID 2728 wrote to memory of 2896	2728	cmd.exe	32
PID 2728 wrote to memory of 2896	2728	cmd.exe	32
PID 2728 wrote to memory of 2896	2728	cmd.exe	32
PID 2728 wrote to memory of 2896	2728	cmd.exe	32
PID 2728 wrote to memory of 2772	2728	cmd.exe	33
PID 2728 wrote to memory of 2772	2728	cmd.exe	33
PID 2728 wrote to memory of 2772	2728	cmd.exe	33
PID 2728 wrote to memory of 2772	2728	cmd.exe	33
PID 2728 wrote to memory of 3008	2728	cmd.exe	34
PID 2728 wrote to memory of 3008	2728	cmd.exe	34
PID 2728 wrote to memory of 3008	2728	cmd.exe	34
PID 2728 wrote to memory of 3008	2728	cmd.exe	34
PID 2728 wrote to memory of 2196	2728	cmd.exe	35
PID 2728 wrote to memory of 2196	2728	cmd.exe	35
PID 2728 wrote to memory of 2196	2728	cmd.exe	35
PID 2728 wrote to memory of 2196	2728	cmd.exe	35
PID 2728 wrote to memory of 2864	2728	cmd.exe	36
PID 2728 wrote to memory of 2864	2728	cmd.exe	36
PID 2728 wrote to memory of 2864	2728	cmd.exe	36
PID 2728 wrote to memory of 2864	2728	cmd.exe	36
PID 2728 wrote to memory of 2736	2728	cmd.exe	37
PID 2728 wrote to memory of 2736	2728	cmd.exe	37
PID 2728 wrote to memory of 2736	2728	cmd.exe	37
PID 2728 wrote to memory of 2736	2728	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build -pubkey pub.key -privkey priv.key
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2196
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32_pass.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2864
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\priv.key

Filesize
344B

MD5
d43d2d010bf3d6d9ebfba7f4cbea3b2e

SHA1
2af577f286da3f2be0d493a9157dba96fcef0ef6

SHA256
784aa6edb914b4052c0d85e5265f967150a8849b06864ea2996c5007cc11a18c

SHA512
b63aa9a3709396d648fd9240dd38c9d5b0eeae737ebcc3d85f8292dc0a3d40205f8fb0ba76c3d60c704fc62cbf35965fad44552c682f11b1825d98b8762bfd46

Download Submit
C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\pub.key

Filesize
344B

MD5
c81d9cbec81104fb6c409e7a99108f18

SHA1
4da12301d75b6a9f0a5255684e5f3d67bceed4e9

SHA256
23bc8b07d860f3cbc234fa2cfafc377e427c8f4064e866194afce6e96f8cdef8

SHA512
28728b38970aaab5463d40a0f2afe3036a1bc3b6136bc3186f85e465586ad33cb3664d90d5659efb7da5325a8a07b70db18ef057b121ac523b274272d7524d3f

Download Submit