locky | 332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926

General

Target

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
Size

231KB
MD5

221b66081f7301bde24f3ec32f71216c
SHA1

c7ac36d8d0414bea71fd67604d0b79b4c7eda831
SHA256

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926
SHA512

a761693c888e1c33820ed24ea08f024663702e7ec6747e8960fa887e1775107e537590cd686bc18b32b293892ccb8ddc57ad8dd831628ea34bab31adb80a673d

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata
Loads dropped DLL 1 IoCs

Processes:

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

pid process

4176 332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

pid	process
4176	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

description	pid	process	target process
PID 4176 set thread context of 4192	4176	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

pid process

4176 332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

pid	process
4176	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

description	pid	process	target process
PID 4176 wrote to memory of 4192	4176	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 4176 wrote to memory of 4192	4176	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 4176 wrote to memory of 4192	4176	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
PID 4176 wrote to memory of 4192	4176	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe	332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe

C:\Users\Admin\AppData\Local\Temp\332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
"C:\Users\Admin\AppData\Local\Temp\332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4176

C:\Users\Admin\AppData\Local\Temp\332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe
"C:\Users\Admin\AppData\Local\Temp\332abe1f0c0e87d525b7629e00e711945048cf02e0622ab072afbc8107053926.exe"
2⤵
PID:4192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl8FA.tmp\System.dll
Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
memory/4176-131-0x0000000002830000-0x000000000284E000-memory.dmp

Filesize
120KB

Download
memory/4176-133-0x0000000002830000-0x000000000284E000-memory.dmp

Filesize
120KB

Download
memory/4192-132-0x0000000000000000-mapping.dmp

Download
memory/4192-134-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/4192-135-0x0000000001FC0000-0x0000000001FE7000-memory.dmp

Filesize
156KB

Download
memory/4192-136-0x0000000001FC0000-0x0000000001FE7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing