Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 17:29
General
- Target 188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe
- Size 3.4MB
- Sample261011-v21a1ax18l
- SHA256 188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99
Malware Config
Signatures
- Family: LegionLocker
Ransomware family active in 2021.
- Detected LegionLocker ransomware 1 IoCs
Sample contains strings associated with the LegionLocker family.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Renames multiple (103) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe"C:\Users\Admin\AppData\Local\Temp\188b2408a0b511905428f95eacc3b60f5c9db195fa8493891baf3db8a4de1e99.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe"C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k color 47 && taskkill /f /im explorer.exe && Exit3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
LegionL0cker.exe
AssertHide.cmd.lock
CheckpointEnter.dxf.lock
ClearClose.pcx.lock
ClearRestore.asx.lock
CopyConvertTo.ttc.lock
DisconnectDismount.rar.lock
EnterLimit.ppsx.lock
ExitFormat.search-ms.lock
ExpandPing.AAC.lock
FormatInstall.vsd.lock
GetMeasure.asp.lock
ImportUnprotect.rle.lock
ImportWrite.mp2.lock
Microsoft Edge.lnk.lock
MoveUndo.hta.lock
OpenProtect.xlsx.lock
OutTest.MOD.lock
RepairFormat.vst.lock
RequestGet.xlsx.lock
ResolvePush.docx.lock
ResolveSave.wmf.lock
RestartRevoke.m3u.lock
RestoreConfirm.bmp.lock
SplitJoin.ogg.lock
SubmitGrant.au.lock
SyncShow.mht.lock
ClearJoin.ods.lock
CloseWatch.ADT
CompressConvertTo.mpe
AddResolve.png.lock
ApproveUpdate.emf.lock
BlockUninstall.crw.lock
CloseSwitch.emz.lock
CompareBackup.dxf.lock
CompleteConvertFrom.cr2
ConnectDisable.raw.lock
ConnectMount.crw.lock
ConnectRegister.bmp.lock
ConvertFromExpand.raw.lock
CopyUse.dwg.lock
DebugInvoke.jpg.lock
DisableSwitch.bmp.lock
EnterComplete.svgz.lock
EnterSuspend.dwg.lock
ExpandJoin.gif.lock
FormatSkip.tif.lock
OpenRepair.svg.lock
OptimizeAssert.svg.lock
PingGet.cr2.lock
PopRequest.raw.lock
ProtectWrite.jpg.lock
RenameTrace.tif.lock
ResetOpen.jpg.lock
ResizeProtect.dib.lock
SubmitCopy.wmf.lock
SuspendSelect.bmp.lock
SuspendUnblock.jpeg.lock
SwitchRequest.jpeg.lock
TestSave.gif.lock
UninstallComplete.tiff.lock
UninstallSearch.wmf.lock
UnregisterSuspend.dwg.lock
UpdateResolve.gif.lock
WaitExpand.eps.lock
hcYW.jpg.lock
memory/3320-25-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-32-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-456-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-360-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-455-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-359-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-56-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-34-0x0000000000EB0000-0x000000000171C000-memory.dmp
memory/3320-33-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-18-0x0000000000EB0000-0x000000000171C000-memory.dmp
memory/3320-19-0x0000000077470000-0x0000000077471000-memory.dmp
memory/3320-20-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-22-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-21-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-55-0x0000000077470000-0x0000000077471000-memory.dmp
memory/3320-24-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-23-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-30-0x0000000000EB0000-0x000000000171C000-memory.dmp
memory/3320-31-0x0000000000EB0000-0x000000000171C000-memory.dmp
memory/3320-361-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-241-0x0000000077450000-0x0000000077540000-memory.dmp
memory/3320-242-0x0000000077450000-0x0000000077540000-memory.dmp
memory/5108-4-0x00000000056B0000-0x00000000056BA000-memory.dmp
memory/5108-3-0x0000000005610000-0x0000000005620000-memory.dmp
memory/5108-2-0x0000000005710000-0x00000000057A2000-memory.dmp
memory/5108-0-0x0000000000940000-0x0000000000CB0000-memory.dmp
memory/5108-1-0x0000000005C20000-0x00000000061C4000-memory.dmp