d81eabd4a25f490b418eef90cfdbae60a288f97980035a6f120e5cd67c1e9b59

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-23_e1188b77d1e81852000b2032a3b5c9b6_cryptolocker.exe
Size

36KB
MD5

e1188b77d1e81852000b2032a3b5c9b6
SHA1

4612bb5640be27f1eb3255102252d3cb402b1a21
SHA256

d81eabd4a25f490b418eef90cfdbae60a288f97980035a6f120e5cd67c1e9b59
SHA512

b83518450b3c9fa4a6fe82b248d9f7cd347cfe954976e2e59eda1ca13f559a0835f69355aa94ee63727692f91fe9d2becc8397073e87a02839d85315e17c4cac
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkCult:YGzl5wjRQBBOsP1QMOtEvwDpjgarrk9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/files/0x00080000000120f8-25.dat	CryptoLocker_rule2
behavioral1/memory/2216-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1796-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1796-13-0x0000000000650000-0x000000000065B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1796-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/files/0x00080000000120f8-25.dat	CryptoLocker_set1
behavioral1/memory/2216-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1796-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1796-13-0x0000000000650000-0x000000000065B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1796-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2216	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1796	2024-01-23_e1188b77d1e81852000b2032a3b5c9b6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2216	1796	2024-01-23_e1188b77d1e81852000b2032a3b5c9b6_cryptolocker.exe	1
PID 1796 wrote to memory of 2216	1796	2024-01-23_e1188b77d1e81852000b2032a3b5c9b6_cryptolocker.exe	1
PID 1796 wrote to memory of 2216	1796	2024-01-23_e1188b77d1e81852000b2032a3b5c9b6_cryptolocker.exe	1
PID 1796 wrote to memory of 2216	1796	2024-01-23_e1188b77d1e81852000b2032a3b5c9b6_cryptolocker.exe	1

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
1⤵
- Executes dropped EXE
PID:2216

C:\Users\Admin\AppData\Local\Temp\2024-01-23_e1188b77d1e81852000b2032a3b5c9b6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-23_e1188b77d1e81852000b2032a3b5c9b6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
43bbc7d1667ba4921a082ddb0185f836

SHA1
1555ee8f583305beb5cd0ad9a96f34f624762f25

SHA256
129efd27a425a6cae5aeb18d20b13fc0edb20188c3fb4a81956147c742016571

SHA512
9169ab90cab35c782e9f37d96f91cf211780de85ade11be526d3d2028175c588c2b1211280e184ece46eb6b0138bf33e0a80eedab50021460906dac819c8c4ba

Download Submit
memory/1796-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1796-13-0x0000000000650000-0x000000000065B000-memory.dmp

Filesize
44KB

Download
memory/1796-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1796-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1796-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1796-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2216-19-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2216-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download