1173900a14a0d9de3390b65df0e77ffe3e719eb58498060055932f50745d2997

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 17:14 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe
Size

38KB
MD5

51711bbe2594539f5e818bfab630356d
SHA1

be0a01b0f18e290b09cf6ca16dc70e3465728489
SHA256

1173900a14a0d9de3390b65df0e77ffe3e719eb58498060055932f50745d2997
SHA512

5fe68e68ee66d940a0d872499b390da8e7b1ce53989636e9fe331a3ab3f6fccaac715794d44ea85b040aaa322155f679b33b994d691e51a94659d9b4d0a02219
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkegAf:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+5

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2444	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2100	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2444	2100	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe	28
PID 2100 wrote to memory of 2444	2100	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe	28
PID 2100 wrote to memory of 2444	2100	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe	28
PID 2100 wrote to memory of 2444	2100	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2444

Network

DNS

emrlogistics.com

asih.exe

Remote address:

8.8.8.8:53

Request

emrlogistics.com

IN A

Response

emrlogistics.com

IN CNAME

traff-6.hugedomains.com

traff-6.hugedomains.com

IN CNAME

hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com

hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com

IN A

18.119.154.66

hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com

IN A

3.140.13.188

18.119.154.66:443

emrlogistics.com

asih.exe

152 B
3
3.140.13.188:443

emrlogistics.com

asih.exe

152 B
3
18.119.154.66:443

emrlogistics.com

asih.exe

152 B
3
3.140.13.188:443

emrlogistics.com

asih.exe

152 B
3
18.119.154.66:443

emrlogistics.com

asih.exe

152 B
3
3.140.13.188:443

emrlogistics.com

asih.exe

152 B
3
18.119.154.66:443

emrlogistics.com

asih.exe

152 B
3
3.140.13.188:443

emrlogistics.com

asih.exe

52 B
1

8.8.8.8:53

emrlogistics.com

dns

asih.exe

62 B
193 B
1
1

DNS Request

emrlogistics.com

DNS Response

18.119.154.66

3.140.13.188

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
31b3afe4ccdb566559b226d6983be81d

SHA1
563dd5b26b711384385b6ffc5bed4c85fb6fa0b4

SHA256
ae305b1abe1be058cd1de62e2f969e35a11d2482c57e2946daa142d2ff0c77bb

SHA512
dcdbf62e6be6df6bed9679e3d14705949ef89f4166df2db45260d21a7a3d8d7dd46c1c910c48561078bf8a1d77094f6f7c63bcc0ec2915f7220c635aea588b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
31b3afe4ccdb566559b226d6983be81d

SHA1
563dd5b26b711384385b6ffc5bed4c85fb6fa0b4

SHA256
ae305b1abe1be058cd1de62e2f969e35a11d2482c57e2946daa142d2ff0c77bb

SHA512
dcdbf62e6be6df6bed9679e3d14705949ef89f4166df2db45260d21a7a3d8d7dd46c1c910c48561078bf8a1d77094f6f7c63bcc0ec2915f7220c635aea588b62

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
31b3afe4ccdb566559b226d6983be81d

SHA1
563dd5b26b711384385b6ffc5bed4c85fb6fa0b4

SHA256
ae305b1abe1be058cd1de62e2f969e35a11d2482c57e2946daa142d2ff0c77bb

SHA512
dcdbf62e6be6df6bed9679e3d14705949ef89f4166df2db45260d21a7a3d8d7dd46c1c910c48561078bf8a1d77094f6f7c63bcc0ec2915f7220c635aea588b62

Download Submit
memory/2100-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2100-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2100-3-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2100-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2100-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2444-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2444-19-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2444-18-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2444-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download