0d55ee7b8da66aae5c9918d60992bdcb44201d2d95517f559afb3f9213cc5369

General

Target

2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe
Size

85KB
MD5

b46fad7d4d7c73bfd0f1014eed18255d
SHA1

dfaba9951391747b525b5c5c1732b03ec5122701
SHA256

0d55ee7b8da66aae5c9918d60992bdcb44201d2d95517f559afb3f9213cc5369
SHA512

157b7a1b66d1bbe5a48a70e4395d7b5704e6efbfbabce0a371962ffd7b5e3adf17aefc5322a33e3f8c5e221c46e2697d4f21709c519c13114e52ce287daf490b
SSDEEP

768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtISX:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgB

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-1-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2356-12-0x0000000000600000-0x000000000060F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2356-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2732-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2732-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-1-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2356-12-0x0000000000600000-0x000000000060F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2356-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2732-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2732-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-1-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2356-12-0x0000000000600000-0x000000000060F000-memory.dmp	UPX
behavioral1/memory/2356-16-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral1/memory/2732-17-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral1/memory/2732-27-0x0000000000500000-0x000000000050F000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2732 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe

pid process

2356 2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe

pid	process
2732	asih.exe

pid	process
2356	2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2356-1-0x0000000000500000-0x000000000050F000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/2356-12-0x0000000000600000-0x000000000060F000-memory.dmp	upx
behavioral1/memory/2356-16-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2732-17-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2732-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe

description	pid	process	target process
PID 2356 wrote to memory of 2732	2356	2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe	asih.exe
PID 2356 wrote to memory of 2732	2356	2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe	asih.exe
PID 2356 wrote to memory of 2732	2356	2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe	asih.exe
PID 2356 wrote to memory of 2732	2356	2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_b46fad7d4d7c73bfd0f1014eed18255d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
85KB

MD5
be3c6cd1bf691c5385e2c9cc57673bb4

SHA1
7f31e0a7968d8dfa1ecaa83e5f558b0fbfb3738c

SHA256
4257488dc66b89cc3ad4202ff0e715f4a3bccb128ec6736fe2f3e412c7fd649b

SHA512
50934a6fe40dddff88e6ef4e0d3d10d0175d3074f7d0192ce922142b75567ca9b2a8c8f0e0b84e4861cf6bfae75fd84a11ba819c19cbe2b68cd2bd6f0af3e256

Download Submit
memory/2356-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2356-1-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2356-3-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2356-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2356-12-0x0000000000600000-0x000000000060F000-memory.dmp

Filesize
60KB

Download
memory/2356-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2732-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2732-20-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2732-19-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2732-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads