clop | 528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378

Analysis

max time kernel
145s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 05:55

Target

528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe
Size

63KB
MD5

8f438f711f16f9d608257b56a34c181d
SHA1

d8d889d977105b88c3d196df9aeb5a536115b22f
SHA256

528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378
SHA512

ea4753904d308b43e9e7cbc24f39ed62c017eaa8b40cab1b6b5c77f28d4d44079eb3fb6a9ef1e10a5e5dd317513afa9365de5651e405581378b8304071e988de
SSDEEP

1536:ro4ZSwAQaNuveqgW61h9Ypm+4r6zPH3A6I8DVmclPCYnrEkG:rvBHageqgX1h3ifpI8DV3CYnrEf

Score

10^/10

clop ransomware upx

Clop
Ransomware discovered in early 2019 which has been actively developed since release.
ransomware clop

Executes dropped EXE 1 IoCs

pid	Process
3264	nokiacheck.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/220-133-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral2/memory/220-138-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nokiacheck.exe	528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe
File created	C:\Windows\SysWOW64\nokiacheck.exe	528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3264	220	528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe	85
PID 220 wrote to memory of 3264	220	528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe	85
PID 220 wrote to memory of 3264	220	528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe	85

C:\Users\Admin\AppData\Local\Temp\528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe
"C:\Users\Admin\AppData\Local\Temp\528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\nokiacheck.exe
  C:\Windows\system32\nokiacheck.exe 1004 "C:\Users\Admin\AppData\Local\Temp\528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378.exe"
  2⤵
  - Executes dropped EXE
  PID:3264

C:\Windows\SysWOW64\nokiacheck.exe

Filesize
63KB

MD5
8f438f711f16f9d608257b56a34c181d

SHA1
d8d889d977105b88c3d196df9aeb5a536115b22f

SHA256
528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378

SHA512
ea4753904d308b43e9e7cbc24f39ed62c017eaa8b40cab1b6b5c77f28d4d44079eb3fb6a9ef1e10a5e5dd317513afa9365de5651e405581378b8304071e988de

Download Submit
C:\Windows\SysWOW64\nokiacheck.exe

Filesize
63KB

MD5
8f438f711f16f9d608257b56a34c181d

SHA1
d8d889d977105b88c3d196df9aeb5a536115b22f

SHA256
528ef1d360ca91056dd002f788e425698a90d4e8090e45d74563252d55806378

SHA512
ea4753904d308b43e9e7cbc24f39ed62c017eaa8b40cab1b6b5c77f28d4d44079eb3fb6a9ef1e10a5e5dd317513afa9365de5651e405581378b8304071e988de

Download Submit
memory/220-132-0x0000000000550000-0x0000000000599000-memory.dmp

Filesize
292KB

Download
memory/220-133-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/220-138-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3264-137-0x0000000000550000-0x0000000000599000-memory.dmp

Filesize
292KB

Download