c298c4bb56178e5d2c721ed6e967962fbbfb4ccd80a638a1972a3227fe46afb0

General

Target

2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe
Size

107KB
MD5

f61000167d97b0e441c446f4bdab832d
SHA1

0e74bd59ec4133917d0d412596885e0e392ed354
SHA256

c298c4bb56178e5d2c721ed6e967962fbbfb4ccd80a638a1972a3227fe46afb0
SHA512

7eeb8261b969ab63bbed1553da0100f7233b56d3e844646001d4cad4008681d56a36840b0131ffc567e56295b3e62a89cefdad675373ab1cd3f1fc01b3a271f6
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GksgEH:1nK6a+qdOOtEvwDpj5

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2212-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2212-15-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2044-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2044-27-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2212-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2212-15-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/2044-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/2044-27-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2212-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2212-15-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/2044-17-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/2044-27-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2044 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe

pid process

2212 2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe

pid	process
2044	asih.exe

pid	process
2212	2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2212-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/2212-15-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2044-17-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2044-27-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe

description	pid	process	target process
PID 2212 wrote to memory of 2044	2212	2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe	asih.exe
PID 2212 wrote to memory of 2044	2212	2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe	asih.exe
PID 2212 wrote to memory of 2044	2212	2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe	asih.exe
PID 2212 wrote to memory of 2044	2212	2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_f61000167d97b0e441c446f4bdab832d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
107KB

MD5
92556ed18c66f8a85285c756e29f66f0

SHA1
3b6a3ec8b9b0b71b24b39e601314adddf314b1ac

SHA256
dbe0660186d67e45ca8a812b8f15b86cf374596fe96f18085bb3978fbb0a4f47

SHA512
852f88ab32fe6393ea4aa126ddbf3ad3314e29f992bbc82c2623049615d02086f3b73816f8fd79a96bd5cdeb2f7b05e88900b49d84150ff164d4e4fd30b683cb

Download Submit
memory/2044-17-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2044-19-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2044-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2044-27-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2212-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2212-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2212-2-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2212-3-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2212-15-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2212-16-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads