MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ec87a7f943ab72d08aeb957d33dd348ab7cf45052ab7a31bcce33ff7a095837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ec87a7f943ab72d08aeb957d33dd348ab7cf45052ab7a31bcce33ff7a095837
SHA3-384 hash: 4b4cef32e7b659882107401712cfb0e00eb1b5c4102ba8194e189a40ccc7aadf1b1230c651147617ad154882931ea1ab
SHA1 hash: ff3e85fec483c637774101194c52a17a6a0598ef
MD5 hash: 7b74e4fb9a95f41d5d9b4a71a5fe40b9
humanhash: winter-eleven-september-ohio
File name:SecuriteInfo.com.Gen.Variant.Nemesis.10729.25107.6533
Download: download sample
Signature LockBit
Create hunting rule
File size:1'770'234 bytes
First seen:2022-09-24 14:07:15 UTC
Last seen:2023-08-27 08:47:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 12288:cbVyGrARa7TAPZfMiuU9YAioFOVdgnFoA7aXKPXPiXuHNHGb6bH/zx/GCLW/nh/B:cb8BwmZ33qAioFmymA7yEpGLm+FFaO
Threatray 14'534 similar samples on MalwareBazaar
TLSH T17285C2083EAE8290FC1145388922C275E7627C601F2D95DBE196BB3E9F379D45F36A13
TrID 50.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
29.5% (.OCX) Windows ActiveX control (116521/4/18)
7.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
4.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
2.6% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):PE icon
dhash icon 00b28eabababa600 (5 x RemcosRAT, 3 x AsyncRAT, 2 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe lockbit

Intelligence

File Origin
# of uploads :
2
# of downloads :
506
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
aaa.exe
Verdict:
Malicious activity
Analysis date:
2022-09-23 07:50:11 UTC
Tags:
ransomware
Link:
https://app.any.run/tasks/51943ef9-699d-4e2b-a16b-6567a1e93434

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/312919/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.10729.25107.6533.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Sending a custom TCP request
Creating a file
Unauthorized injection to a recently created process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Сreating synchronization primitives
Launching a service
Delayed writing of the file
Changing a file
Moving a recently created file
Reading critical registry keys
Using the Windows Management Instrumentation requests
Stealing user critical data
Creating a file in the mass storage device
Forced shutdown of a browser
Encrypting user's files
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/38793/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lockbit nemesis overlay ransomware shell32.dll
Link:
https://www.filescan.io/uploads/632f0f4ea627570911fe53da/reports/ed675296-a4d7-47f7-85dc-374d56847be8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/df7a375c-887b-4a62-bff5-53aef93c8983
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1076496
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found ransom note / readme
Found Tor onion address
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Writes to foreign memory regions
Yara detected LockBit ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 709038 Sample: SecuriteInfo.com.Gen.Varian... Startdate: 24/09/2022 Architecture: WINDOWS Score: 100 42 Malicious sample detected (through community Yara rule) 2->42 44 Antivirus detection for URL or domain 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 3 other signatures 2->48 7 SecuriteInfo.com.Gen.Variant.Nemesis.10729.25107.6533.exe 18 2->7         started        process3 file4 30 C:\Users\user\AppData\Local\...\System.dll, PE32 7->30 dropped 58 Contains functionality to detect hardware virtualization (CPUID execution measurement) 7->58 60 Writes a notice file (html or txt) to demand a ransom 7->60 62 Maps a DLL or memory area into another process 7->62 64 Injects a PE file into a foreign processes 7->64 11 SecuriteInfo.com.Gen.Variant.Nemesis.10729.25107.6533.exe 2 34 7->11         started        15 WerFault.exe 23 9 7->15         started        signatures5 process6 dnsIp7 32 C:\Users\user\...\VWDFPKGDUF.mp3.fu28x4MDV, COM 11->32 dropped 34 C:\Users\user\...\UNKRLCVOHV.docx.fu28x4MDV, COM 11->34 dropped 36 C:\ProgramData481.tmp, PE32 11->36 dropped 38 10 other malicious files 11->38 dropped 66 Writes to foreign memory regions 11->66 68 Hides threads from debuggers 11->68 70 Modifies existing user documents (likely ransomware behavior) 11->70 18 E481.tmp 2 11->18         started        40 192.168.2.1 unknown unknown 15->40 file8 signatures9 process10 file11 22 ZZZZZZZZZZZZZZZZZZ...ZZZZZZZZZZZZ (copy), data 18->22 dropped 24 YYYYYYYYYYYYYYYYYY...YYYYYYYYYYYY (copy), data 18->24 dropped 26 XXXXXXXXXXXXXXXXXX...XXXXXXXXXXXX (copy), data 18->26 dropped 28 24 other malicious files 18->28 dropped 50 Antivirus detection for dropped file 18->50 52 Multi AV Scanner detection for dropped file 18->52 54 Contains functionality to detect hardware virtualization (CPUID execution measurement) 18->54 56 2 other signatures 18->56 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ec87a7f943ab72d08aeb957d33dd348ab7cf45052ab7a31bcce33ff7a095837/
Threat name:
Win32.Ransomware.Lockbit
Create hunting rule
Status:
Malicious
First seen:
2022-09-23 02:37:40 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3ehu74uhk3s2cfoxfl5gpotjcvxz5cqkkvxumn4zyz766qjla3q._file
Verdict:
malicious
Similar samples:
963043215c54f2a5b1ae6a53787ed78c838beb576e2744e304665f611c7fcb60
LockBit
a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e
LockBit
c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2
LockBit
d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee
LockBit
+ 14'524 additional samples on MalwareBazaar
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit ransomware
Link:
https://tria.ge/reports/220924-rfh8tacffr/
Behaviour
Modifies Control Panel
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Deletes itself
Loads dropped DLL
Executes dropped EXE
Modifies extensions of user files
Lockbit
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fed173bb-51a4-4075-8322-4534ea2df3dc
Unpacked files
SH256 hash:
0ec87a7f943ab72d08aeb957d33dd348ab7cf45052ab7a31bcce33ff7a095837
MD5 hash:
7b74e4fb9a95f41d5d9b4a71a5fe40b9
SHA1 hash:
ff3e85fec483c637774101194c52a17a6a0598ef
Link:
https://www.unpac.me/results/0c29ff0a-cb63-4306-8eef-73692eb65101/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0ec87a7f943a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ec87a7f943ab72d08aeb957d33dd348ab7cf45052ab7a31bcce33ff7a095837

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_NullSoftInst_Combo_Oct20_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious NullSoft Installer combination with common Copyright strings
Reference:https://twitter.com/malwrhunterteam/status/1313023627177193472

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LockBit

Executable exe 0ec87a7f943ab72d08aeb957d33dd348ab7cf45052ab7a31bcce33ff7a095837

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2312762/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/312919/

Comments