7f6528ce5ebb8dcf7598d26d606db1d7f6419593ce589af363a4fcb18668f2b0

Analysis

user interaction
yes
max time kernel
84s
max time network
64s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LockBit/Build.bat
Size 767B
Sample261111-ned1xsft8k
SHA256 7f6528ce5ebb8dcf7598d26d606db1d7f6419593ce589af363a4fcb18668f2b0
MD5 0173b6cb7d6c8c41e73f8a6518a089d8
SHA1 790d4a3d7db86aa8ebb8c4af2a8d138266164643
SHA512 ebe66e432e7693b2d5851f4c08d5289e2b5364d1bf327a1ba912d49e5b5cf3fa03886d30d2abc747747899451ff9db02e830566c61eb3708614e903aba45d7df
TLSH
T187014873C08958B358779C48A5F1DB16FFAF3BC68AC3808DD91C763D5226022173629B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2876	824	cmd.exe	90
PID 824 wrote to memory of 5868	824	cmd.exe	91
PID 824 wrote to memory of 952	824	cmd.exe	92
PID 824 wrote to memory of 6136	824	cmd.exe	93
PID 824 wrote to memory of 5320	824	cmd.exe	94
PID 824 wrote to memory of 4920	824	cmd.exe	95
PID 824 wrote to memory of 4104	824	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LockBit\Build.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\LockBit\keygen.exe
  keygen -path "C:\Users\Admin\AppData\Local\Temp\LockBit\Build" -pubkey pub.key -privkey priv.key
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- C:\Users\Admin\AppData\Local\Temp\LockBit\builder.exe
  builder -type dec -privkey "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\priv.key" -config config.json -ofile "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\LB3Decryptor.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5868
- C:\Users\Admin\AppData\Local\Temp\LockBit\builder.exe
  builder -type enc -exe -pubkey "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\pub.key" -config config.json -ofile "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\LB3.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:952
- C:\Users\Admin\AppData\Local\Temp\LockBit\builder.exe
  builder -type enc -exe -pass -pubkey "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\pub.key" -config config.json -ofile "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\LB3_pass.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6136
- C:\Users\Admin\AppData\Local\Temp\LockBit\builder.exe
  builder -type enc -dll -pubkey "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\pub.key" -config config.json -ofile "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\LB3_Rundll32.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5320
- C:\Users\Admin\AppData\Local\Temp\LockBit\builder.exe
  builder -type enc -dll -pass -pubkey "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\pub.key" -config config.json -ofile "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\LB3_Rundll32_pass.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Users\Admin\AppData\Local\Temp\LockBit\builder.exe
  builder -type enc -ref -pubkey "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\pub.key" -config config.json -ofile "C:\Users\Admin\AppData\Local\Temp\LockBit\Build\LB3_ReflectiveDll_DllMain.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

priv.key

Path C:\Users\Admin\AppData\Local\Temp\LockBit\Build\priv.key
Size 344B
SHA256 bb426c24e94558e0c634fbaee20f51840825f8ed07eafeb225e8652429fcce9b
MD5 ebd5422ca67c1ce38ceb9e1988382f10
SHA1 aff2776a6a6ceb0b36ac775001d291878e6a057b
SHA512 349de60192dfc7082066981ca2c525bd7ac45ba2bf01bcfd677c059e842323c37e2675f7baa38b951e29e20702b6f38e184fb351a689b8bf4e080725fafb2b51
TLSH
T1D2E0C0799088A68804446A22517A2538E26302467A6412D81815DB07C31FB5446210E6
MD5 SHA1 SHA512 TLSH

Submit Download

pub.key

Path C:\Users\Admin\AppData\Local\Temp\LockBit\Build\pub.key
Size 344B
SHA256 8d5ec302f8d5f76777f5884aa09fe3449967d3ba5e3b3f721e1a96de69a81a89
MD5 7e7680d389715790a0f665827105555d
SHA1 8eb795a33e838535f8087ffaa88e492c76d49cfa
SHA512 0d1e6bb2054f7d2564c845c70845396a34d1363065c3915eb9100e421ee2eb16a046a28862c0a21fe9d4924e51843fc5576d6b2c35982907acc9998d567c2c43
TLSH
T18FE0C0759184EEB8580C4033212718109D1303833BB413D08418CC07C72F7040931437
MD5 SHA1 SHA512 TLSH