34ae59b7acc09c2e82625640cae82c5158b649db1418ddbaa24138b51f1722c5

Analysis

max time kernel
104s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LockBit-Black-Builder-main/LockBit3Builder/Build.bat
Size

733B
MD5

1905cc9973206fea5050b737f9303fb4
SHA1

497524177d9478a4b5dca3e73cc230be6abf4ce0
SHA256

e2f5b93040d57de6251d16256bcd04aa8eb337bde87308e602f01070efd345fb
SHA512

95bae9406d01083f6fe6916ecf8e889afe20ff5863070f1787dc7a60d2d1d5af2cf3fd481a3c4fb531f16dd2cb7a685002aaac1dc907cf189c19c60f2816dd76

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3200	1176	cmd.exe	87
PID 1176 wrote to memory of 3200	1176	cmd.exe	87
PID 1176 wrote to memory of 3200	1176	cmd.exe	87
PID 1176 wrote to memory of 4160	1176	cmd.exe	88
PID 1176 wrote to memory of 4160	1176	cmd.exe	88
PID 1176 wrote to memory of 4160	1176	cmd.exe	88
PID 1176 wrote to memory of 228	1176	cmd.exe	89
PID 1176 wrote to memory of 228	1176	cmd.exe	89
PID 1176 wrote to memory of 228	1176	cmd.exe	89
PID 1176 wrote to memory of 1576	1176	cmd.exe	90
PID 1176 wrote to memory of 1576	1176	cmd.exe	90
PID 1176 wrote to memory of 1576	1176	cmd.exe	90
PID 1176 wrote to memory of 2256	1176	cmd.exe	91
PID 1176 wrote to memory of 2256	1176	cmd.exe	91
PID 1176 wrote to memory of 2256	1176	cmd.exe	91
PID 1176 wrote to memory of 6044	1176	cmd.exe	92
PID 1176 wrote to memory of 6044	1176	cmd.exe	92
PID 1176 wrote to memory of 6044	1176	cmd.exe	92
PID 1176 wrote to memory of 5848	1176	cmd.exe	93
PID 1176 wrote to memory of 5848	1176	cmd.exe	93
PID 1176 wrote to memory of 5848	1176	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build -pubkey pub.key -privkey priv.key
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3200
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4160
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:228
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_Rundll32.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2256
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_Rundll32_pass.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6044
- C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\priv.key

Filesize
344B

MD5
9ed30b14dff79bb837a6bd5aad641d3e

SHA1
9668e0372a9c783a3c15041460e1ee4c1239f204

SHA256
4663da45d6ffb4610381b39a24ce82505688f8b5292f00d390287df2f086bf4c

SHA512
299c5c333e62efd12bd921c12464f0f433bbbc780fc60f85591e09552af037b3242deef38fef20c7e41984378baf565211489fc7d3cd7f228a5bd239699f1f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\pub.key

Filesize
344B

MD5
23be2f656c971df9a3a01cdbcfcd95ad

SHA1
1e41bcff75dc980f05548d26dcd72a3f2ca732a8

SHA256
8b065bace1248ac04d08e607f367b1b33d5c3e3478ef48fe90f8d2152792b351

SHA512
0229aca00aa618b0839dee2a1cc13636c436d6f89ee2fff78c4d6624fd2e09bcab6723f8bef6f2d3340b7a58af350f7f6895db915ef41748c421d95af315a1e4

Download Submit