locky | 2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2

General

Target

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
Size

216KB
MD5

4271f704912273f76587d3cd506f621c
SHA1

431e581b28dfc9fb9a3a1a6ee463e8a75b560768
SHA256

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2
SHA512

c91234c36f7bae904035f329643ec16f9ae683ba1ec2aa0a7f2af867445d99fa98562c1bdf82315d49accd11c09de15e452a56acf07950dacde0286cc6c4eea5

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\DisableResume.tiff	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

Loads dropped DLL 1 IoCs

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

pid process

4412 2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

pid	process
4412	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

description	pid	process	target process
PID 4412 set thread context of 1944	4412	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

pid process

4412 2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

pid	process
4412	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

description	pid	process	target process
PID 4412 wrote to memory of 1944	4412	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 4412 wrote to memory of 1944	4412	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 4412 wrote to memory of 1944	4412	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
PID 4412 wrote to memory of 1944	4412	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe	2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe

C:\Users\Admin\AppData\Local\Temp\2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
"C:\Users\Admin\AppData\Local\Temp\2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4412

C:\Users\Admin\AppData\Local\Temp\2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe
"C:\Users\Admin\AppData\Local\Temp\2abb94d7cc6ed4f72b4d4a74052310cc9dd21694db5c8b2b3df54472f8d72ce2.exe"
2⤵
- Modifies extensions of user files
PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsiE0B.tmp\System.dll
Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
memory/1944-132-0x0000000000000000-mapping.dmp

Download
memory/1944-134-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/1944-135-0x0000000000720000-0x0000000000747000-memory.dmp

Filesize
156KB

Download
memory/1944-136-0x0000000000720000-0x0000000000747000-memory.dmp

Filesize
156KB

Download
memory/4412-131-0x0000000002830000-0x000000000284D000-memory.dmp

Filesize
116KB

Download
memory/4412-133-0x0000000002830000-0x000000000284D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads