LockBit 2.0 walkthrough: anti-debug, language gates and the wallpaper trick

by psyrun / 2022-03-31 / Ransomware

LockBit began operating as ransomware-as-a-service in late 2019, and the 2.0 release in mid-2021 made it one of the most active families. Access is commonly obtained through brute-forced RDP, unpatched services, or purchased access.

Execution flow

cmd.exe
 |- vssadmin.exe delete shadows /all /quiet
 |- wmic shadowcopy delete
 |- bcdedit /set {default} bootstatuspolicy ignoreallfailures
 `- bcdedit /set {default} recoveryenabled no

What happens inside the binary

  1. Debugger check at the entry point. The sample reads a flag from the process environment block that is set when a debugger is attached. If it is set, execution drops into an endless loop.
  2. Strings on the stack. Module names are built as XOR-encoded stack strings and decoded only when needed.
  3. Language gate. The UI language of the current user is compared with a hard-coded list of identifiers (for example Azerbaijani and Belarusian). On a match the malware stops without touching anything.
  4. Single instance. A fixed mutex stops it from running twice.
  5. Persistence. A value in the standard Run key points to the dropped copy.
  6. Short sleep of about fifteen seconds before the main routine.

Encryption phase

The encryptor lists volumes, mounts any that are not mounted, walks directories and encrypts files, adding the extension .lockbit. A note named Restore-My-Files.txt is written in every directory it visits.

A neat detail: the desktop background is replaced by an HTA file dropped as LockBit_Ransomware.hta, which renders the instructions as a full-screen wallpaper.

mutex      : \BaseNamedObjects\{60026D00-6002-4402-B1C6-388A8AA73873}
run key    : HKCU\...\CurrentVersion\Run  ->  {2C5F9FCC-F266-43F6-BFD7-838DAE269E11}
note       : Restore-My-Files.txt  (every folder)
wallpaper  : LockBit_Ransomware.hta
extension  : .lockbit

Embedded contact points

The binary carries an onion address for the operators, a link to the Tox messenger download page and a clearnet blog address.

Why it is awkward to reverse

Anti-debugging, encoded strings and encoded module names all combine so that static strings give almost nothing. Patching out the debugger flag check and dumping the decoded stack strings makes the rest straightforward.