Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2024 04:46

General

  • Target

    2024-01-29_de348cc7e266faa613cb8a0f6e4bd914_cryptolocker.exe

  • Size

    61KB

  • MD5

    de348cc7e266faa613cb8a0f6e4bd914

  • SHA1

    ad7010a01eaf4e52af962bd4492f263eca4b8b75

  • SHA256

    2edc4aaa570bdfec33eb9cb7757051a5ae79dae7e141a239afcb8ce8f9e3ebb9

  • SHA512

    bde9404238add7fd974dc8f74cd1ff394b78d05bcfcc221c688fae6e0f39ed3a5cf8d5d632d18ae58d62a21b542314c3d523b75dbf25d3e331740bcf1567decb

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF299j:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7r

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-29_de348cc7e266faa613cb8a0f6e4bd914_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-29_de348cc7e266faa613cb8a0f6e4bd914_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2432

Network

  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    180.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    180.178.17.96.in-addr.arpa
    IN PTR
    Response
    180.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-180deploystaticakamaitechnologiescom
  • flag-us
    DNS
    gemlttwi.com
    hurok.exe
    Remote address:
    8.8.8.8:53
    Request
    gemlttwi.com
    IN A
    Response
    gemlttwi.com
    IN A
    192.185.35.56
  • flag-us
    GET
    https://gemlttwi.com/tech/2mr.exe
    hurok.exe
    Remote address:
    192.185.35.56:443
    Request
    GET /tech/2mr.exe HTTP/1.1
    Accept: text/*, application/*
    User-Agent: Updates downloader
    Host: gemlttwi.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 29 Jan 2024 04:46:19 GMT
    Server: Apache
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Link: <https://gemlttwi.com/wp-json/>; rel="https://api.w.org/"
    Upgrade: h2,h2c
    Connection: Upgrade
    Vary: Accept-Encoding
    X-Endurance-Cache-Level: 2
    X-nginx-cache: WordPress
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.35.185.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.35.185.192.in-addr.arpa
    IN PTR
    Response
    56.35.185.192.in-addr.arpa
    IN PTR
    immacbytescom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.149.64.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.149.64.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    233.38.18.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    233.38.18.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    10.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.173.189.20.in-addr.arpa
    IN PTR
    Response
  • 192.185.35.56:443
    https://gemlttwi.com/tech/2mr.exe
    tls, http
    hurok.exe
    4.5kB
    110.8kB
    89
    86

    HTTP Request

    GET https://gemlttwi.com/tech/2mr.exe

    HTTP Response

    404
  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    180.178.17.96.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    180.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    gemlttwi.com
    dns
    hurok.exe
    58 B
    74 B
    1
    1

    DNS Request

    gemlttwi.com

    DNS Response

    192.185.35.56

  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    56.35.185.192.in-addr.arpa
    dns
    72 B
    100 B
    1
    1

    DNS Request

    56.35.185.192.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    23.149.64.172.in-addr.arpa
    dns
    72 B
    134 B
    1
    1

    DNS Request

    23.149.64.172.in-addr.arpa

  • 8.8.8.8:53
    233.38.18.104.in-addr.arpa
    dns
    72 B
    134 B
    1
    1

    DNS Request

    233.38.18.104.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    10.173.189.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    10.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    61KB

    MD5

    484549625f490a083151bf146485fa89

    SHA1

    e33ff6879dc587779bfb863951cabe59db9c8db9

    SHA256

    5ef068c225072fe7c0d0ea0f34f9f282a229fb09bda4aecd87355d00e6f6dfd1

    SHA512

    161c1511efa034cc83adaa4a25aed89a390ccffd4865423afce94d1bdcea3e2749d0a95a3161800bd702bbdf50c562cecf9996816ecc207b23782a54469057e4

  • memory/1464-0-0x00000000021C0000-0x00000000021C6000-memory.dmp

    Filesize

    24KB

  • memory/1464-1-0x00000000021C0000-0x00000000021C6000-memory.dmp

    Filesize

    24KB

  • memory/1464-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2432-24-0x0000000000550000-0x0000000000556000-memory.dmp

    Filesize

    24KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.