Analysis

  • max time kernel
    137s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2024, 20:22 UTC

General

  • Target

    2024-01-23_158424424e87f5d5fa9637808ea83d8d_cryptolocker.exe

  • Size

    59KB

  • MD5

    158424424e87f5d5fa9637808ea83d8d

  • SHA1

    79ea72129b2a10ef86b4e5a3b9409d00ade835a3

  • SHA256

    e12e6497d5705906d2fa99fc06f90367e1dd046ec9124e433a268ca8241e61d1

  • SHA512

    ea67380a5177f14d9fe31c1dc46aa9facc22134b0e92952d342d8367f8d7ea1efa96603bcf54ce87f958e877be4a8bd2f4a83751b016c86bac5820a47a198f76

  • SSDEEP

    1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMs:TCjsIOtEvwDpj5HE/OUHnSMr

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-23_158424424e87f5d5fa9637808ea83d8d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-23_158424424e87f5d5fa9637808ea83d8d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2964

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    bestccc.com
    misid.exe
    Remote address:
    8.8.8.8:53
    Request
    bestccc.com
    IN A
    Response
    bestccc.com
    IN A
    103.14.121.240
  • flag-in
    GET
    https://bestccc.com/hr/ho2.exe
    misid.exe
    Remote address:
    103.14.121.240:443
    Request
    GET /hr/ho2.exe HTTP/1.1
    Accept: text/*, application/*
    User-Agent: Updates downloader
    Host: bestccc.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Tue, 23 Jan 2024 20:19:01 GMT
    Server: Apache/2
    Content-Length: 315
    Content-Type: text/html; charset=iso-8859-1
  • flag-us
    DNS
    185.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    185.178.17.96.in-addr.arpa
    IN PTR
    Response
    185.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-185deploystaticakamaitechnologiescom
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    crl.comodoca.com
    misid.exe
    Remote address:
    8.8.8.8:53
    Request
    crl.comodoca.com
    IN A
    Response
    crl.comodoca.com
    IN CNAME
    crl.comodoca.com.cdn.cloudflare.net
    crl.comodoca.com.cdn.cloudflare.net
    IN A
    104.18.38.233
    crl.comodoca.com.cdn.cloudflare.net
    IN A
    172.64.149.23
  • flag-us
    GET
    http://crl.comodoca.com/cPanelIncCertificationAuthority.crl
    misid.exe
    Remote address:
    104.18.38.233:80
    Request
    GET /cPanelIncCertificationAuthority.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: crl.comodoca.com
    Response
    HTTP/1.1 200 OK
    Date: Tue, 23 Jan 2024 20:22:58 GMT
    Content-Type: application/pkix-crl
    Content-Length: 59750
    Connection: keep-alive
    Last-Modified: Tue, 23 Jan 2024 01:50:45 GMT
    ETag: "65af1b75-e966"
    X-CCACDN-Mirror-ID: mscrl1
    Cache-Control: max-age=14400, s-maxage=3600
    Expires: Tue, 30 Jan 2024 01:50:45 GMT
    X-CCACDN-Proxy-ID: mcdpinlb2
    X-Frame-Options: SAMEORIGIN
    CF-Cache-Status: HIT
    Age: 2063
    Accept-Ranges: bytes
    Server: cloudflare
    CF-RAY: 84a2c07a6a6524ba-LHR
  • flag-us
    DNS
    240.121.14.103.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.121.14.103.in-addr.arpa
    IN PTR
    Response
    240.121.14.103.in-addr.arpa
    IN PTR
    10314121240-static-reversegooddomainregistrycom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    233.38.18.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    233.38.18.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    150.1.37.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    150.1.37.23.in-addr.arpa
    IN PTR
    Response
    150.1.37.23.in-addr.arpa
    IN PTR
    a23-37-1-150deploystaticakamaitechnologiescom
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    134.71.91.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    134.71.91.104.in-addr.arpa
    IN PTR
    Response
    134.71.91.104.in-addr.arpa
    IN PTR
    a104-91-71-134deploystaticakamaitechnologiescom
  • flag-us
    DNS
    211.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    211.178.17.96.in-addr.arpa
    IN PTR
    Response
    211.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-211deploystaticakamaitechnologiescom
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 103.14.121.240:443
    https://bestccc.com/hr/ho2.exe
    tls, http
    misid.exe
    1.1kB
    5.8kB
    13
    9

    HTTP Request

    GET https://bestccc.com/hr/ho2.exe

    HTTP Response

    404
  • 104.18.38.233:80
    http://crl.comodoca.com/cPanelIncCertificationAuthority.crl
    http
    misid.exe
    1.4kB
    62.1kB
    27
    47

    HTTP Request

    GET http://crl.comodoca.com/cPanelIncCertificationAuthority.crl

    HTTP Response

    200
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    bestccc.com
    dns
    misid.exe
    57 B
    73 B
    1
    1

    DNS Request

    bestccc.com

    DNS Response

    103.14.121.240

  • 8.8.8.8:53
    185.178.17.96.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    185.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    crl.comodoca.com
    dns
    misid.exe
    62 B
    143 B
    1
    1

    DNS Request

    crl.comodoca.com

    DNS Response

    104.18.38.233
    172.64.149.23

  • 8.8.8.8:53
    240.121.14.103.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    240.121.14.103.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    233.38.18.104.in-addr.arpa
    dns
    72 B
    134 B
    1
    1

    DNS Request

    233.38.18.104.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    150.1.37.23.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    150.1.37.23.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    134.71.91.104.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    134.71.91.104.in-addr.arpa

  • 8.8.8.8:53
    211.178.17.96.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    211.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    59KB

    MD5

    c8102581e155fbf12c23f9e27e27deda

    SHA1

    8fed08cc5d1fa714ff9b93cdb7374ffe889ae486

    SHA256

    65702a45f93c730b9d819c969700519b6c545e2a766b706956ace4adced3c8c7

    SHA512

    780ff7f3871d02b92aced99ad4ec6cea83cec9bd7a81813e1c998bb267953269d879bd5ca51564e33766370932f99a0676fed681b7d5eb71ed281fde52c8e222

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/2964-20-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/2964-19-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/2964-22-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/2964-49-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/4788-0-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

  • memory/4788-3-0x0000000000600000-0x0000000000606000-memory.dmp

    Filesize

    24KB

  • memory/4788-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/4788-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/4788-18-0x0000000000500000-0x000000000050E000-memory.dmp

    Filesize

    56KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.