b263399f6f4b6ce81507200784dad9501acce47843f69a06b6e92c8dc70ee4e6

Analysis

max time kernel
160s
max time network
177s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe
Size

36KB
MD5

3ac7936b97cbaa62a5f3a537ceefcde3
SHA1

90e1f2244d8211d27d62f1ffdd92428fd09e692f
SHA256

b263399f6f4b6ce81507200784dad9501acce47843f69a06b6e92c8dc70ee4e6
SHA512

74be1b129aa70a067c8fa89db3dace4b0a3a43925e32155cd91c522a0ab3a6afb0e2be599af8f72b194512faec50d95ff1447fe165c7ffcbc26821fc62000cce
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiM8Nekdvjl9V50i3NbB1k:bAvJCYOOvbRPDEgXrNekd7l94i3pw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2732	demka.exe

Loads dropped DLL 1 IoCs

pid	Process
1108	NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1108	NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe
2732	demka.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2732	1108	NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe	27
PID 1108 wrote to memory of 2732	1108	NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe	27
PID 1108 wrote to memory of 2732	1108	NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe	27
PID 1108 wrote to memory of 2732	1108	NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_3ac7936b97cbaa62a5f3a537ceefcde3_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
36KB

MD5
e41974f4f5c90163113c821f5b048ed2

SHA1
1ef4091f0767db11688dbaad864f1e4f5a60ae1b

SHA256
89f289ec13f4af086984dd21de04ad69de4ecb95fe911b16d808f7ea18b06eae

SHA512
b36ee1b314145965adcaa6938ca6d149ac55d684ddffbc32f32d7c04de2552e4347b6c0ec7d323b441bdb29d7006725c5c0e28bd9da9e23483b9cdb1d2a31fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
36KB

MD5
e41974f4f5c90163113c821f5b048ed2

SHA1
1ef4091f0767db11688dbaad864f1e4f5a60ae1b

SHA256
89f289ec13f4af086984dd21de04ad69de4ecb95fe911b16d808f7ea18b06eae

SHA512
b36ee1b314145965adcaa6938ca6d149ac55d684ddffbc32f32d7c04de2552e4347b6c0ec7d323b441bdb29d7006725c5c0e28bd9da9e23483b9cdb1d2a31fa5

Download Submit
\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
36KB

MD5
e41974f4f5c90163113c821f5b048ed2

SHA1
1ef4091f0767db11688dbaad864f1e4f5a60ae1b

SHA256
89f289ec13f4af086984dd21de04ad69de4ecb95fe911b16d808f7ea18b06eae

SHA512
b36ee1b314145965adcaa6938ca6d149ac55d684ddffbc32f32d7c04de2552e4347b6c0ec7d323b441bdb29d7006725c5c0e28bd9da9e23483b9cdb1d2a31fa5

Download Submit
memory/1108-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/1108-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1108-2-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2732-17-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download