Analysis
-
max time kernel
186s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-07-2022 07:11
General
-
Target
4c4836b640c5c0b9150cd19747ebc1ae94793788721df2f4392544ac281bc91a.exe
-
Size
306KB
-
MD5
c3e44673beef5ea9729f961ae675970a
-
SHA1
9a123902896be80475be8bd360f5449ae800f358
-
SHA256
4c4836b640c5c0b9150cd19747ebc1ae94793788721df2f4392544ac281bc91a
-
SHA512
10fb7d2ea7909b8a062fb1e50b02f3cdd4d7227061ccb0cbc20c05556d121c2814406a836454f094329f33e084c00ceb72c9981e34c334d36c5a16c8ab60de13
Malware Config
Signatures
-
CryptoLocker
Ransomware family with multiple variants.
-
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
-
Executes dropped EXE 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c4836b640c5c0b9150cd19747ebc1ae94793788721df2f4392544ac281bc91a.exe"C:\Users\Admin\AppData\Local\Temp\4c4836b640c5c0b9150cd19747ebc1ae94793788721df2f4392544ac281bc91a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\AppData\Local\Temp\4c4836b640c5c0b9150cd19747ebc1ae94793788721df2f4392544ac281bc91a.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000000C83⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306KB
MD5c3e44673beef5ea9729f961ae675970a
SHA19a123902896be80475be8bd360f5449ae800f358
SHA2564c4836b640c5c0b9150cd19747ebc1ae94793788721df2f4392544ac281bc91a
SHA51210fb7d2ea7909b8a062fb1e50b02f3cdd4d7227061ccb0cbc20c05556d121c2814406a836454f094329f33e084c00ceb72c9981e34c334d36c5a16c8ab60de13
-
Filesize
306KB
MD5c3e44673beef5ea9729f961ae675970a
SHA19a123902896be80475be8bd360f5449ae800f358
SHA2564c4836b640c5c0b9150cd19747ebc1ae94793788721df2f4392544ac281bc91a
SHA51210fb7d2ea7909b8a062fb1e50b02f3cdd4d7227061ccb0cbc20c05556d121c2814406a836454f094329f33e084c00ceb72c9981e34c334d36c5a16c8ab60de13
-
Filesize
306KB
MD5c3e44673beef5ea9729f961ae675970a
SHA19a123902896be80475be8bd360f5449ae800f358
SHA2564c4836b640c5c0b9150cd19747ebc1ae94793788721df2f4392544ac281bc91a
SHA51210fb7d2ea7909b8a062fb1e50b02f3cdd4d7227061ccb0cbc20c05556d121c2814406a836454f094329f33e084c00ceb72c9981e34c334d36c5a16c8ab60de13
-
Filesize
8KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
372KB
-
-
Filesize
372KB
-
-
Filesize
372KB