20efe6a58e1e0aae88947ac46450b53f397ebc6fd0ff1a69493b143c0be50ff6

Analysis

max time kernel
8s
max time network
146s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe
Size

31KB
MD5

cecee9eb9e5d66ec00c18b42c65b302a
SHA1

67d408e0e4135419ac4aab9b8ffa3d363807a6fd
SHA256

20efe6a58e1e0aae88947ac46450b53f397ebc6fd0ff1a69493b143c0be50ff6
SHA512

2afb80c31d16d47fedade8798b6703f3a626736d704b9b3de00bbc4547ebde3f05ee8ea4b8d8cc179c24a80ccf03a590589546a2fb057f441bdbc6632108dd92
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AmfS:b/yC4GyNM01GuQMNXw2PSjHWS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2540	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
1100	NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1100	NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe
2540	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2540	1100	NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe	28
PID 1100 wrote to memory of 2540	1100	NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe	28
PID 1100 wrote to memory of 2540	1100	NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe	28
PID 1100 wrote to memory of 2540	1100	NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_cecee9eb9e5d66ec00c18b42c65b302a_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
31KB

MD5
f8134135459bd92e05166c81720640e2

SHA1
91b292bf30ab81a027d103d8312b46f7e2ef4088

SHA256
b50da8fb11518ef6a0dd994de23a9522d84c8c12b4af957a35234ccb6a15c1e2

SHA512
125ae4ede631511d3c9d3a205f4da7170e787c7024a4bceef479bdef028f0edaea5585ae77155b30dce263df43144d6258a53b578e5fcf33f39ca44d7d21bb4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
31KB

MD5
f8134135459bd92e05166c81720640e2

SHA1
91b292bf30ab81a027d103d8312b46f7e2ef4088

SHA256
b50da8fb11518ef6a0dd994de23a9522d84c8c12b4af957a35234ccb6a15c1e2

SHA512
125ae4ede631511d3c9d3a205f4da7170e787c7024a4bceef479bdef028f0edaea5585ae77155b30dce263df43144d6258a53b578e5fcf33f39ca44d7d21bb4e

Download Submit
\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
31KB

MD5
f8134135459bd92e05166c81720640e2

SHA1
91b292bf30ab81a027d103d8312b46f7e2ef4088

SHA256
b50da8fb11518ef6a0dd994de23a9522d84c8c12b4af957a35234ccb6a15c1e2

SHA512
125ae4ede631511d3c9d3a205f4da7170e787c7024a4bceef479bdef028f0edaea5585ae77155b30dce263df43144d6258a53b578e5fcf33f39ca44d7d21bb4e

Download Submit
memory/1100-0-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1100-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1100-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2540-16-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download