b3d5a2fc9e0983c03f602583c8b4f46a5c3605dfb99938b7f7e78aa42218ecbb

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_c26dae1b6256c574ee6ceef61ff90ef4_cryptolocker.exe
Size

104KB
MD5

c26dae1b6256c574ee6ceef61ff90ef4
SHA1

66858e0142beb2c238d0f5a700c1fdc29fe3e011
SHA256

b3d5a2fc9e0983c03f602583c8b4f46a5c3605dfb99938b7f7e78aa42218ecbb
SHA512

864467dc3433bec6ee38fa014841f7b9fdf718277fed83cf23896c9f167d0119fc34639cae4840f04308f3c0612d5dbcb7509652b4321fca9f68b8bcb01ec6de
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gksq:1nK6a+qdOOtEvwDpjq

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/1352-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0007000000012284-11.dat	CryptoLocker_rule2
behavioral1/memory/1352-16-0x0000000002800000-0x0000000002810000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2388-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1352-15-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2388-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/1352-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0007000000012284-11.dat	CryptoLocker_set1
behavioral1/memory/1352-16-0x0000000002800000-0x0000000002810000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2388-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/1352-15-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/2388-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/1352-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/files/0x0007000000012284-11.dat	UPX
behavioral1/memory/2388-17-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/1352-15-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/2388-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2388	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1352	2024-01-25_c26dae1b6256c574ee6ceef61ff90ef4_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1352-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0007000000012284-11.dat	upx
behavioral1/memory/2388-17-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/1352-15-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2388-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2388	1352	2024-01-25_c26dae1b6256c574ee6ceef61ff90ef4_cryptolocker.exe	28
PID 1352 wrote to memory of 2388	1352	2024-01-25_c26dae1b6256c574ee6ceef61ff90ef4_cryptolocker.exe	28
PID 1352 wrote to memory of 2388	1352	2024-01-25_c26dae1b6256c574ee6ceef61ff90ef4_cryptolocker.exe	28
PID 1352 wrote to memory of 2388	1352	2024-01-25_c26dae1b6256c574ee6ceef61ff90ef4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-25_c26dae1b6256c574ee6ceef61ff90ef4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_c26dae1b6256c574ee6ceef61ff90ef4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
104KB

MD5
6726caea45a7ae45a017a6456d5af5fe

SHA1
8bf34a818bf63c25c97663d341eea0ab7064dc97

SHA256
62860ddcc0380f866c92344c704942dfcf7c9e4453258b0318901c49555b6c68

SHA512
83b5bc79abec80b35c342d072f9eabb69310ced876f13d0fca803165cb3f97d820574b74b47394fa981c593a4229fb57387ac0686cb6dc317cd284db6e6f84be

Download Submit
memory/1352-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1352-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1352-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1352-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1352-16-0x0000000002800000-0x0000000002810000-memory.dmp

Filesize
64KB

Download
memory/1352-15-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2388-17-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2388-19-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2388-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download