Managed XDR

hgl.exe (Lockbit) — malware analysis report

File info

Filename
hgl.exe
File type
PE32+ executable (console) x86-64, for MS Windows
File size
1.2 MB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
c1c7604869285c461535f99e5f5ed556f0b6a077
SHA256
63b9fb6c070c2c03cc9f5b75581550949d6b0ee3ce1eaecdad32119777b34453
MD5
4e83f8cd1e15c24fa25ec978149a7d45

Malwares

  • Lockbit

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1070.004 deletes_self: Moves to different location or removes the original executable file
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497 evasion_diskenum: Sandbox evasion using enumeration of partitions
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1552 infostealer_mail: Collects personal data from local email clients
T1552.001 infostealer_bitcoin: Attempts to obtain access to Bitcoin/ALTCoin wallets
T1503 infostealer_browser: Retrieves personal information from local Internet browsers
T1552 infostealer_browser: Retrieves personal information from local Internet browsers
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_diskenum: Sandbox evasion using enumeration of partitions

Collection

T1114 infostealer_mail: Collects personal data from local email clients

Impact

T1486 modifies_files2: Cryptolocker indicators detected (500 or more files are modified)
T1486 modifies_files: Cryptolocker indicators detected (renamed 500 or more files)
T1489 stops_service: Stops Windows services
T1565.001 overwrites_firefox_settings: Modifies Mozilla Firefox settings
T1486 ransomware_message: Ransomware indicators detected (possible ransom message creation)
T1489 change_service_config: Stops services via ChangeServiceConfig

Other

lockbit: Detected ransomware Lockbit
accesses_mailslot: Performs a Mailslot ping, possibly used to get Domain Controller information
create_rpc_bindings: Creates RPC connection
require_administrator: Requests administrator privileges
creates_in_programdata: Creates files in the ProgramData directory
test_check_service: Starts services
writes_data: Writes big amount of data to disk

Related reports

Managed XDR