2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2

General

Target

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
Size

216KB
MD5

4271f704912273f76587d3cd506f621c
SHA1

431e581b28dfc9fb9a3a1a6ee463e8a75b560768
SHA256

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2
SHA512

c91234c36f7bae904035f329643ec16f9ae683ba1ec2aa0a7f2af867445d99fa98562c1bdf82315d49accd11c09de15e452a56acf07950dacde0286cc6c4eea5

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata
Loads dropped DLL 1 IoCs

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

pid process

1992 2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

pid	process
1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

description	pid	process	target process
PID 1992 set thread context of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

pid process

1992 2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

pid	process
1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

description	pid	process	target process
PID 1992 wrote to memory of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 1992 wrote to memory of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 1992 wrote to memory of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 1992 wrote to memory of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 1992 wrote to memory of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 1992 wrote to memory of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 1992 wrote to memory of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 1992 wrote to memory of 1612	1992	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

C:\Users\Admin\AppData\Local\Temp\2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
"C:\Users\Admin\AppData\Local\Temp\2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
"C:\Users\Admin\AppData\Local\Temp\2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe"
2⤵
PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd6C6.tmp\System.dll
Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
memory/1612-57-0x00000000001D56BA-mapping.dmp

Download
memory/1612-60-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/1612-61-0x00000000003A0000-0x00000000003C7000-memory.dmp

Filesize
156KB

Download
memory/1992-54-0x0000000074E91000-0x0000000074E93000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000001E30000-0x0000000001E4D000-memory.dmp

Filesize
116KB

Download
memory/1992-59-0x0000000001E30000-0x0000000001E4D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing