locky | ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6

General

Target

ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
Size

217KB
MD5

91c17565508fc5b288d467109e3aef48
SHA1

cac9d66842779bd61ebf4592c7e52862bc8c9347
SHA256

ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6
SHA512

ba5e78bbc02e193422546291878796f4e10147616c64c42d9a5ee202cb558971d1b42276c5ef799671be0e19b7d862f672ba9b4e704e80576bcebbc4dc3ff5f6
SSDEEP

3072:NFvbdafaNL5WMg5ZMRQrZ5eT+UOtnDNoGMxCl7zjfJX115BymGuDLhGEyseRR8Ti:NFvbgg5WWQ9a+tVMC7l11bLhZeYTTsd

Score

10^/10

locky locky_osiris ransomware upx

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/772-54-0x0000000001370000-0x000000000139C000-memory.dmp	upx
behavioral1/memory/772-55-0x0000000001370000-0x000000000139C000-memory.dmp	upx
behavioral1/memory/772-68-0x0000000001370000-0x000000000139C000-memory.dmp	upx
behavioral1/memory/588-71-0x0000000001370000-0x000000000139C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe

description	pid	process	target process
PID 772 set thread context of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe

description	pid	process	target process
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe

C:\Users\Admin\AppData\Local\Temp\ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
"C:\Users\Admin\AppData\Local\Temp\ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:772

C:\Users\Admin\AppData\Local\Temp\ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
"C:\Users\Admin\AppData\Local\Temp\ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe"
2⤵
PID:588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-66-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-59-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-75-0x0000000000200000-0x0000000000227000-memory.dmp

Filesize
156KB

Download
memory/588-57-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-74-0x0000000000200000-0x0000000000227000-memory.dmp

Filesize
156KB

Download
memory/588-61-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-63-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-67-0x000000000040570D-mapping.dmp

Download
memory/588-56-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-73-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-65-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-70-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/588-71-0x0000000001370000-0x000000000139C000-memory.dmp

Filesize
176KB

Download
memory/588-72-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/772-55-0x0000000001370000-0x000000000139C000-memory.dmp

Filesize
176KB

Download
memory/772-68-0x0000000001370000-0x000000000139C000-memory.dmp

Filesize
176KB

Download
memory/772-54-0x0000000001370000-0x000000000139C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads