f476d333754a58c4a70a0b521d8c0e64a3a61f444aae5598a871a38c51f44ffb

Analysis

max time kernel
14s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe
Size

30KB
MD5

c26ac7ed16a16a37da5b95ae01413d43
SHA1

c752559f896eccfeba95f09a1cdac14cdb70360f
SHA256

f476d333754a58c4a70a0b521d8c0e64a3a61f444aae5598a871a38c51f44ffb
SHA512

8e135f9cc72b7a81ba71671dc77a5df3b1706aead09d1662534fda17ae3dbb4636d8f38047d91c11fbca9fac0dc265ad619412bb34ebeb73257564ae43db2e22
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSzn8YS:b/yC4GyNM01GuQMNXw2PSjW

Score

9^/10

discovery

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

1728 retln.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe

pid process

2056 2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exeretln.exe

pid process

2056 2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe
1728 retln.exe

pid	process
1728	retln.exe

pid	process
2056	2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe

pid	process
2056	2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe
1728	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe

description	pid	process	target process
PID 2056 wrote to memory of 1728	2056	2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe	retln.exe
PID 2056 wrote to memory of 1728	2056	2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe	retln.exe
PID 2056 wrote to memory of 1728	2056	2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe	retln.exe
PID 2056 wrote to memory of 1728	2056	2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe	retln.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2056

C:\Users\Admin\AppData\Local\Temp\retln.exe
"C:\Users\Admin\AppData\Local\Temp\retln.exe"
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
31KB

MD5
db2a5e08bad3c44745644ce23758c4a2

SHA1
ca8b08607595f09ac2d7c9aa693cecda09c2d5f2

SHA256
a976a97b2e9af1ee322697e1fe71f8f926d17dc2be073493bb43e799a6926518

SHA512
e8dce39a76a71bfc1cc2474995ac3712e3d9935edf61c64a1f8ba9c4662a8c9dae1519033f229a3245f3cbfa59a379f150dbdc6f62c98a4465467927ad83b66b

Download Submit
memory/1728-23-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2056-0-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2056-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2056-8-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download