8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339

Analysis

user interaction
yes
max time kernel
18s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LBLeak/Build.bat
Size 741B
Sample261002-kbe72astes
SHA256 8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
MD5 4e46e28b2e61643f6af70a8b19e5cb1f
SHA1 804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA512 009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b
TLSH
T19001E173C48A3873585A9C24E5F5DB25DFFF3BC69A43904ED118632D822602156362EF
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1172	1700	cmd.exe	89
PID 1700 wrote to memory of 3220	1700	cmd.exe	90
PID 1700 wrote to memory of 2848	1700	cmd.exe	91
PID 1700 wrote to memory of 2396	1700	cmd.exe	92
PID 1700 wrote to memory of 3236	1700	cmd.exe	93
PID 1700 wrote to memory of 3556	1700	cmd.exe	94
PID 1700 wrote to memory of 5088	1700	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LBLeak\Build.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\LBLeak\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\LBLeak\Build -pubkey pub.key -privkey priv.key
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3Decryptor.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_pass.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_Rundll32.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3236
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_Rundll32_pass.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3556
- C:\Users\Admin\AppData\Local\Temp\LBLeak\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

priv.key

Path C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\priv.key
Size 344B
SHA256 3eb21669f80608c15ef6755b6ebf475bc7f5f318253d7cd5c082e4b276bf8662
MD5 7309260e20b79885b39edce2c26d32ea
SHA1 d207e3c92e2dfd2f5277fca10251f70e875dc350
SHA512 0f8680abf24ae327472b0bdd67fb8bfbc98d84fcaca44a5ff7f22601965a1546f9ac4e0aacdd5d4edaf8af71008cb227ffb341db1d13a150071021b73182d8f8
TLSH
T1B0E0C6A3389143B7E26131E07E0628BA60E2B8F520065892AAF2B730D89D681F926D05
MD5 SHA1 SHA512 TLSH

Submit Download

pub.key

Path C:\Users\Admin\AppData\Local\Temp\LBLeak\Build\pub.key
Size 344B
SHA256 dfe1a2840b8ef01d7db80631ba2c86257c500167465f0b5be8447f1e15fa38ed
MD5 52d2d68f29a8634d508b4ef8f70dae31
SHA1 e179114252e960bf67c938c6ac18deea6dc43ef9
SHA512 a6635d5371668e49191a19ab7fb97a2463d2f6a6b0ad3a549d1babd74aaa1dceaa28e1ffb10052520c277ad75002cc69b9c04af5bc3134d17470ad67c9432107
TLSH
T1E2E01273245286BAF5551250AE5926BAADD178E71007C884A8E175E1DC4D282F969504
MD5 SHA1 SHA512 TLSH