lockbit | d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973

General

Target
_d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe
Size 146KB
Sample260529-phkhjsct5m
SHA256 d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973
MD5 9a09e701d79bc9048160d861dbafcb18
SHA1 06dc8b0505092d93c9c4fe60de0434d93321d7a6
SHA512 04985b7ed24c94e1b771c8ec78a55c984f6afeaeb08990b32378f86fbff5a1afbb7195193679e613b03b645a1e4a5adc3cd0034cd484ae935a0753d8faa846f1
SSDEEP 3072:s6glyuxE4GsUPnliByocWepWLl1F9Z2uOyIk:s6gDBGpvEByocWekLHROyj
TLSH
T137E37D21F212D0B3C83718F13736B172F39A8D6C19A96847EAD80F5DBCA58236F45997
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973.exe
- Size 146KB
- SHA256 d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973
- MD5 9a09e701d79bc9048160d861dbafcb18
- SHA1 06dc8b0505092d93c9c4fe60de0434d93321d7a6
- SHA512 04985b7ed24c94e1b771c8ec78a55c984f6afeaeb08990b32378f86fbff5a1afbb7195193679e613b03b645a1e4a5adc3cd0034cd484ae935a0753d8faa846f1
- SSDEEP 3072:s6glyuxE4GsUPnliByocWepWLl1F9Z2uOyIk:s6gDBGpvEByocWekLHROyj
- TLSH
  T137E37D21F212D0B3C83718F13736B172F39A8D6C19A96847EAD80F5DBCA58236F45997
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (928) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2