MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LockBit

Vendor detections: 14

Intelligence 14 IOCs YARA 13 File information Comments 1

SHA256 hash:	c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f
SHA3-384 hash:	87d3726682e24a7b0ebc81f1d01042edd63251e3946cec5dbe743a1a31b42338a4d0c7fd446c40ec3a7c0fa606ccd6eb
SHA1 hash:	874630d6f4bdf9224125d35f30c48bc6d1da8ec1
MD5 hash:	df7a9a45a10c1942225eb9be257fb752
humanhash:	queen-red-beer-grey
File name:	df7a9a45a10c1942225eb9be257fb752
Download:	download sample
Signature	LockBit Create hunting rule
File size:	982'528 bytes
First seen:	2022-12-12 15:15:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	216df81b1ef7bc2aa8ec52bbeef137c9 (38 x LockBit)
ssdeep	24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdsF:Ujrc2So1Ff+B3k796e
TLSH	T124253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4505/5/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	zbetcheckin
Tags:	32 exe lockbit

Intelligence

File Origin

# of uploads :

# of downloads :

313

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

3b55624bf812c25712465543d5c0d687f523d3a93f6879817cef93dffef20888.docx

Verdict:

Malicious activity

Analysis date:

2022-12-12 14:17:02 UTC

Tags:

loader

Link:

https://app.any.run/tasks/974f9b38-ed45-4943-bb01-240c45196060

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Lockbit

Link:

https://www.capesandbox.com/analysis/345493/

Detection(s):

Win.Trojan.Obfus-43

Win.Ransomware.Lockbit-9886605-0

Win.Ransomware.LockBit-9888870-1

Result

Verdict:

Malware

Maliciousness:

Behaviour

Adding an access-denied ACE

Сreating synchronization primitives

Creating a file in the Windows subdirectories

Changing a file

Creating a file

Moving a recently created file

Creating a file in the Program Files subdirectories

Moving a file to the Program Files subdirectory

Creating a window

Modifying an executable file

Running batch commands

Creating a process with a hidden window

Searching for synchronization primitives

Launching a service

Replacing files

Launching a process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Creating a file in the mass storage device

Deleting volume shadow copies

Preventing system recovery

Encrypting user's files

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm cmd.exe evasive exploit explorer.exe obfuscated shell32.dll

Link:

https://www.filescan.io/uploads/639745b475655a0108eaabd3/reports/1eaad527-a39f-43ef-a5b0-7d5784bbd912/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

LockBit Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e97e46e7-93d6-452e-ab66-00d87fe9f3d9

Result

Threat name:

LockBit ransomware

Detection:

malicious

Classification:

rans.spre.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1132758

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Contains functionality to hide a thread from the debugger

Creates autostart registry keys with suspicious names

Deletes shadow drive data (may be related to ransomware)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found ransom note / readme

Found Tor onion address

Hides threads from debuggers

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May disable shadow drive data (uses vssadmin)

Modifies existing user documents (likely ransomware behavior)

Multi AV Scanner detection for submitted file

Sigma detected: Delete shadow copy via WMIC

Spreads via windows shares (copies files to share folders)

Uses bcdedit to modify the Windows boot settings

Writes a notice file (html or txt) to demand a ransom

Yara detected LockBit ransomware

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f/

Threat name:

Win32.Ransomware.LockBit

Status:

Malicious

First seen:

2022-12-12 12:25:14 UTC

File Type:

PE (Exe)

AV detection:

35 of 39 (89.74%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ymrqyjfunh7f3atymrcnhr5h2fwxr23flaoictn4kmu2qc3fjapq._file

Verdict:

malicious

Result

Malware family:

lockbit

Score:

10/10

Tags:

family:lockbit discovery evasion persistence ransomware

Link:

https://tria.ge/reports/221212-snfnbsed4w/

Behaviour

Interacts with shadow copies

Modifies Control Panel

Modifies registry class

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Checks computer location settings

Modifies extensions of user files

Creates a large amount of network flows

Deletes shadow copies

Modifies boot configuration data using bcdedit

Lockbit

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5381cd55-13fa-464d-86c7-b9901b423bf8

Unpacked files

SH256 hash:

c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f

MD5 hash:

df7a9a45a10c1942225eb9be257fb752

SHA1 hash:

874630d6f4bdf9224125d35f30c48bc6d1da8ec1

Link:

https://www.unpac.me/results/d9bf1d63-32c6-4d9f-acb3-20658da5a629/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c3230c24b469/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ICMLuaUtil_UACMe_M41 Create hunting rule
Author:	Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:	A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:	https://github.com/hfiref0x/UACME

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defedner features

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	INDICATOR_SUSPICIOUS_USNDeleteJournal Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing anti-forensic artifcats of deletiing USN change journal. Observed in ransomware

Rule name:	Lockbit Create hunting rule
Author:	kevoreilly
Description:	Lockbit Payload

Rule name:	Lockbit2_Jul21 Create hunting rule
Author:	CB @ ATR
Description:	simple rule to detect latest Lockbit ransomware Jul 2021

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	RAN_Lockbit_Dec_2021_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect Lockbit ransomware
Reference:	Internal Research

Rule name:	SUSP_XORed_URL_in_EXE Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	Win32_Ransomware_LockBit Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects LockBit ransomware.

Rule name:	Windows_Ransomware_Lockbit_89e64044 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Ransomware_Lockbit_a1c60939 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LockBit

exe c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2454881/

Cape

https://www.capesandbox.com/analysis/345493/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-12-12 15:15:59 UTC

url : hxxp://195.201.101.146/12341rgergg435g4tr.exe