332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926

General

Target

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
Size

231KB
MD5

221b66081f7301bde24f3ec32f71216c
SHA1

c7ac36d8d0414bea71fd67604d0b79b4c7eda831
SHA256

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926
SHA512

a761693c888e1c33820ed24ea08f024663702e7ec6747e8960fa887e1775107e537590cd686bc18b32b293892ccb8ddc57ad8dd831628ea34bab31adb80a673d

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata
Loads dropped DLL 1 IoCs

Processes:

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

pid process

304 332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

pid	process
304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

description	pid	process	target process
PID 304 set thread context of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

pid process

304 332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

pid	process
304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

description	pid	process	target process
PID 304 wrote to memory of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 304 wrote to memory of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 304 wrote to memory of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 304 wrote to memory of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 304 wrote to memory of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 304 wrote to memory of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 304 wrote to memory of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 304 wrote to memory of 2016	304	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

C:\Users\Admin\AppData\Local\Temp\332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
"C:\Users\Admin\AppData\Local\Temp\332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Local\Temp\332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
"C:\Users\Admin\AppData\Local\Temp\332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe"
2⤵
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso4D67.tmp\System.dll
Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
memory/304-54-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download
memory/304-56-0x0000000000500000-0x000000000051E000-memory.dmp

Filesize
120KB

Download
memory/304-59-0x0000000000500000-0x000000000051E000-memory.dmp

Filesize
120KB

Download
memory/2016-57-0x00000000001D56BA-mapping.dmp

Download
memory/2016-60-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/2016-61-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/2016-62-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing