MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LockBit

Vendor detections: 13

Intelligence 13 IOCs YARA 12 File information Comments

SHA256 hash:	0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9
SHA3-384 hash:	70be5345a8b8f66ccfd694f2a567427f687c35d720f715a5b3d3634d54b4851d03759113501aa9830af15f090afa9688
SHA1 hash:	bcebe09c61d3e6c47aefcb6bca0882752e0053a9
MD5 hash:	ebe673b2ee28dd65565f2f389279ac47
humanhash:	oxygen-delta-asparagus-solar
File name:	0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9
Download:	download sample
Signature	LockBit Create hunting rule
File size:	154'112 bytes
First seen:	2022-06-30 11:53:58 UTC
Last seen:	2023-04-08 18:04:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	be232aa2621354bf5dd7b405cc99198c (8 x LockBit)
ssdeep	3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/R:pq/1VP1OyysNmJyXsqqD/ls/R
Threatray	13 similar samples on MalwareBazaar
TLSH	T1E9E3093D7498E361C88F00B1BE2516BAE271F83C137495E3EBD34D6A9510FE96626B13
TrID	38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 13.0% (.EXE) Win64 Executable (generic) (10523/12/4) 8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	JAMESWT_WT
Tags:	exe lockbit

Intelligence

File Origin

# of uploads :

# of downloads :

610

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Lockbit

Link:

https://www.capesandbox.com/analysis/284583/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Creating a window

Searching for the window

Searching for synchronization primitives

Enabling the 'hidden' option for recently created files

Changing a file

Replacing files

Moving a recently created file

Moving a file to the Program Files subdirectory

Creating a file in the Program Files subdirectories

Running batch commands

Creating a process with a hidden window

Launching a service

Launching a process

Creating a file in the Windows subdirectories

Using the Windows Management Instrumentation requests

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Creating a file in the mass storage device

Deleting volume shadow copies

Preventing system recovery

Forced shutdown of a browser

Encrypting user's files

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm cmd.exe exploit explorer.exe greyware obfuscated shell32.dll

Link:

https://www.filescan.io/uploads/62bd8f181756f979fbcc1bdd/reports/8b65e8b7-8d90-42e2-a49e-5cfb2b244e8f/overview

Malware family:

LockBit Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/33706674-b197-4900-b5ca-3ef5c2d4ac44

Result

Threat name:

LockBit ransomware

Detection:

malicious

Classification:

rans.spre.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1022576

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Contains functionality to hide a thread from the debugger

Creates files inside the volume driver (system volume information)

Deletes shadow drive data (may be related to ransomware)

Deletes the backup plan of Windows

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found ransom note / readme

Found stalling execution ending in API Sleep call

Found Tor onion address

Hides threads from debuggers

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May disable shadow drive data (uses vssadmin)

Modifies existing user documents (likely ransomware behavior)

Multi AV Scanner detection for submitted file

Spreads via windows shares (copies files to share folders)

Uses bcdedit to modify the Windows boot settings

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Yara detected LockBit ransomware

Yara detected RansomwareGeneric

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9/

Threat name:

Win32.Ransomware.LockBit

Status:

Malicious

First seen:

2021-08-25 21:19:33 UTC

File Type:

PE (Exe)

AV detection:

25 of 26 (96.15%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bocwgn6z2msv7q5qoy273lpmx2b6epvvyic6zsvyhqq4f63w5xeq._file

Verdict:

malicious

Result

Malware family:

lockbit

Score:

10/10

Tags:

family:lockbit evasion persistence ransomware

Link:

https://tria.ge/reports/220630-n2vl7acgf6/

Behaviour

Checks SCSI registry key(s)

Interacts with shadow copies

Modifies Control Panel

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Checks computer location settings

Deletes backup catalog

Modifies extensions of user files

Deletes shadow copies

Modifies boot configuration data using bcdedit

Lockbit

Unpacked files

SH256 hash:

0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9

MD5 hash:

ebe673b2ee28dd65565f2f389279ac47

SHA1 hash:

bcebe09c61d3e6c47aefcb6bca0882752e0053a9

Detections:

win_lockbit_auto

Link:

https://www.unpac.me/results/523f9d76-cb30-46d6-a213-ee6e952b4a31/

Malware family:

LockBit

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0b856337d9d3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_ransom_lockbit_1 Create hunting rule
Author:	@VK_Intel
Description:	Detects LockBit ransomware
Reference:	twitter

Rule name:	ICMLuaUtil_UACMe_M41 Create hunting rule
Author:	Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:	A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:	https://github.com/hfiref0x/UACME

Rule name:	INDICATOR_SUSPICIOUS_ClearWinLogs Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing commands for clearing Windows Event Logs

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	INDICATOR_SUSPICIOUS_GENRansomware Create hunting rule
Author:	ditekSHen
Description:	detects command variations typically used by ransomware

Rule name:	INDICATOR_SUSPICIOUS_USNDeleteJournal Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing anti-forensic artifcats of deletiing USN change journal. Observed in ransomware

Rule name:	INDICATOR_SUSPICOUS_EXE_References_VEEAM Create hunting rule
Description:	Detects executables containing many references to VEEAM. Observed in ransomware

Rule name:	INDICATOR_SUSPICOUS_EXE_References_VEEAM Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing many references to VEEAM. Observed in ransomware

Rule name:	Lockbit Create hunting rule
Author:	kevoreilly
Description:	Lockbit Payload

Rule name:	SUSP_XORed_URL_in_EXE Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	win_lockbit_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lockbit.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/284583/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample