MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 411b8cd39606bbe551627f1868bb4ace1f9fcb5387b6a58b9bb7f31c50109e10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 411b8cd39606bbe551627f1868bb4ace1f9fcb5387b6a58b9bb7f31c50109e10
SHA3-384 hash: 08fc24829398037e33312f67a604ec71958fe07f1198a45852e882c9a1a73f2596ca912a54bcb51c84fa941d2ad745eb
SHA1 hash: f7a2fc4e471a203c8a5683c02ada2c3931c8f0ec
MD5 hash: fe5101b50e92a923d74cc6f0f4225539
humanhash: snake-alaska-april-august
File name:fdrsetrgh.exe
Download: download sample
Signature LockBit
Create hunting rule
File size:1'593'708 bytes
First seen:2022-12-01 14:44:44 UTC
Last seen:2022-12-01 16:32:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (728 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 24576:EbRKGN66DdkfD2mtArFoZpAQbuSy6Pj44aOLu5S3+RIYMpS:+RK4ZWDVt4G2r67458tYMU
Threatray 59 similar samples on MalwareBazaar
TLSH T16B75019FA48441A5FD669CBCA12F0D46C3B7257EE36028C737EA3A52A9E72734337405
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon a6674f2b2335414b (1 x LockBit)
Reporter pr0xylife
Tags:exe lockbit

Intelligence

File Origin
# of uploads :
2
# of downloads :
359
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
심주아.zip
Verdict:
Malicious activity
Analysis date:
2022-11-23 06:06:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f7308edd-6727-4f90-842f-e67045472be6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lockbit
Create hunting rule
Link:
https://www.capesandbox.com/analysis/341167/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.63830642.7913.14914.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
DNS request
Creating a file
Unauthorized injection to a recently created process
Searching for synchronization primitives
Adding an access-denied ACE
Сreating synchronization primitives
Creating a file in the Windows subdirectories
Changing a file
Moving a recently created file
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Replacing files
Modifying an executable file
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Creating a window
Running batch commands
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Preventing system recovery
Encrypting user's files
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay shell32.dll
Link:
https://www.filescan.io/uploads/6388bdf06ab8d544984c5449/reports/fbe48bc9-40ea-48a3-ae40-7d7690375f6b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/92c4d6be-c063-4c25-9a16-61615da534ed
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.spre.expl.evad.troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1125462
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to hide a thread from the debugger
Creates autostart registry keys with suspicious names
Deletes shadow drive data (may be related to ransomware)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found ransom note / readme
Found Tor onion address
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Sigma detected: Delete shadow copy via WMIC
Spreads via windows shares (copies files to share folders)
Uses bcdedit to modify the Windows boot settings
Writes a notice file (html or txt) to demand a ransom
Yara detected LockBit ransomware
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 758188 Sample: fdrsetrgh.exe Startdate: 01/12/2022 Architecture: WINDOWS Score: 100 76 Malicious sample detected (through community Yara rule) 2->76 78 Antivirus detection for URL or domain 2->78 80 Antivirus / Scanner detection for submitted sample 2->80 82 6 other signatures 2->82 8 fdrsetrgh.exe 18 2->8         started        12 fdrsetrgh.exe 17 2->12         started        14 fdrsetrgh.exe 2->14         started        16 fdrsetrgh.exe 2->16         started        process3 file4 56 C:\Users\user\AppData\Local\...\System.dll, PE32 8->56 dropped 92 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 8->92 94 Deletes shadow drive data (may be related to ransomware) 8->94 96 Writes a notice file (html or txt) to demand a ransom 8->96 102 2 other signatures 8->102 18 fdrsetrgh.exe 8 507 8->18         started        23 WerFault.exe 8->23         started        25 WerFault.exe 8->25         started        58 C:\Users\user\AppData\Local\...\System.dll, PE32 12->58 dropped 98 Maps a DLL or memory area into another process 12->98 100 Injects a PE file into a foreign processes 12->100 27 WerFault.exe 12->27         started        29 fdrsetrgh.exe 12->29         started        31 WerFault.exe 12->31         started        60 C:\Users\user\AppData\Local\...\System.dll, PE32 14->60 dropped 62 C:\Users\user\AppData\Local\...\System.dll, PE32 16->62 dropped signatures5 process6 dnsIp7 64 192.168.2.100 unknown unknown 18->64 66 192.168.2.101 unknown unknown 18->66 68 98 other IPs or domains 18->68 44 C:\Users\user\Desktop\Restore-My-Files.txt, ASCII 18->44 dropped 46 C:\Users\user\...\Restore-My-Files.txt, ASCII 18->46 dropped 48 C:\Users\user\...\Restore-My-Files.txt, ASCII 18->48 dropped 54 19 other files (7 malicious) 18->54 dropped 84 Connects to many different private IPs via SMB (likely to spread or exploit) 18->84 86 Connects to many different private IPs (likely to spread or exploit) 18->86 88 Creates autostart registry keys with suspicious names 18->88 90 5 other signatures 18->90 33 cmd.exe 1 18->33         started        50 C:\ProgramData\Microsoft\...\Report.wer, Unicode 23->50 dropped 52 C:\ProgramData\Microsoft\...\Report.wer, Unicode 27->52 dropped file8 signatures9 process10 signatures11 70 May disable shadow drive data (uses vssadmin) 33->70 72 Deletes shadow drive data (may be related to ransomware) 33->72 74 Uses bcdedit to modify the Windows boot settings 33->74 36 WMIC.exe 1 33->36         started        38 conhost.exe 33->38         started        40 vssadmin.exe 1 33->40         started        42 2 other processes 33->42 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/411b8cd39606bbe551627f1868bb4ace1f9fcb5387b6a58b9bb7f31c50109e10/
Threat name:
Win32.Ransomware.Lockbit
Create hunting rule
Status:
Malicious
First seen:
2022-11-22 22:27:54 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ienyzu4wa256kulcp4mgro2kzypz7s2tq63klc43w7zryuaqtyia._file
Verdict:
malicious
Similar samples:
2cf51d2d9edcfcd6fe5a8c323149832858f9655742dd5e327ee182960e558ad3
LockBit
5a67b802ccb3ff343066d6f285b8c933dbd9b43da1e7592f512d54d6e517b5ee
LockBit
8d141b8ef137032125cece55ec945038c35d4eeed54ce43e0b99c2731e8790ba
LockBit
9aa88ce395cd32b972f79afe6855d74e1071b7a79b6acadeefa2d0c2f6a4530c
LockBit
c6902f14bafb0fa5c7b46a3afe0ff71245c0bb26ac07b187ff58fd3fa381dbcb
LockBit
e786673320cd80373f1f1bdd717082d5ea074c4464e2b15874d93dc3cfe35ee1
LockBit
f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4
LockBit
+ 49 additional samples on MalwareBazaar
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit discovery evasion persistence ransomware
Link:
https://tria.ge/reports/221201-r4rj4acg3v/
Behaviour
Interacts with shadow copies
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Creates a large amount of network flows
Deletes shadow copies
Modifies boot configuration data using bcdedit
Lockbit
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8feb84e1-51cd-443a-acd6-04f84eace78b
Unpacked files
SH256 hash:
411b8cd39606bbe551627f1868bb4ace1f9fcb5387b6a58b9bb7f31c50109e10
MD5 hash:
fe5101b50e92a923d74cc6f0f4225539
SHA1 hash:
f7a2fc4e471a203c8a5683c02ada2c3931c8f0ec
Link:
https://www.unpac.me/results/e31c7846-aa05-4b94-ae32-e3dd5ef6b604/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/411b8cd39606bbe551627f1868bb4ace1f9fcb5387b6a58b9bb7f31c50109e10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_NullSoftInst_Combo_Oct20_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious NullSoft Installer combination with common Copyright strings
Reference:https://twitter.com/malwrhunterteam/status/1313023627177193472

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LockBit

Executable exe 411b8cd39606bbe551627f1868bb4ace1f9fcb5387b6a58b9bb7f31c50109e10

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/341167/
  
URLhaus
https://urlhaus.abuse.ch/url/2441525/
  
Delivery method
Distributed via web download

Comments