61c573f2cdcf8e5a2734408407559746774d5950e2ef874a38ba022d65d67bf5

Analysis

max time kernel
0s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe
Size

36KB
MD5

4dbfb24ec6b9576ca1e5668e4c0619fe
SHA1

7b8389f21d821e184736e5e8d43ad1d0b846c30f
SHA256

61c573f2cdcf8e5a2734408407559746774d5950e2ef874a38ba022d65d67bf5
SHA512

e7af818e7b87f56eed3cf0a3b73d08211e2554cf2b52fd0d415befb029ecac3c6d452b4a6817d1c71ed48234654cda471d9a7b2cbfc85f13dcc8eb1c44271988
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlb:b/yC4GyNM01GuQMNXw2PSjHPbSuYlb

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2712	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
2136	2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2136	2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe
2712	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2712	2136	2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe	21
PID 2136 wrote to memory of 2712	2136	2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe	21
PID 2136 wrote to memory of 2712	2136	2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe	21
PID 2136 wrote to memory of 2712	2136	2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe	21

C:\Users\Admin\AppData\Local\Temp\2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_4dbfb24ec6b9576ca1e5668e4c0619fe_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
37KB

MD5
a9262767a896c23340eac4d13216199c

SHA1
d11fa381dc0453297bbaf5ac215b88817fb18c3b

SHA256
8fee13b1d2f9b7164509c3506df9cf55b50d3879dd1f01d9baefef882092eb33

SHA512
35af3b7c138d041a5108c620a3b832e7cf6525d08c9edef337662c0a8dc796b49e7f24478e4abab7f343b33a6df50511e9100945807dab7a4d4d427b479a1454

Download Submit
memory/2136-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2136-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2136-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2712-23-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download