bc6eadb089010235df76fdbd59cba77d58ab800abcf28411e277054aa52685e7

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe
Size

46KB
MD5

5563e7e8f4902a4785121afe42e171cf
SHA1

510c647d1f431b3cc0df188462b7b795a879e960
SHA256

bc6eadb089010235df76fdbd59cba77d58ab800abcf28411e277054aa52685e7
SHA512

bc76990e967268185a0a4289f0da0c73bc21c2ca304451ef785e837214038e0e3f534276699d4469665dbcba8112800f723d57259e250475d9570dd8147f4261
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05WTB6:qmbhXDmjr5MOtEvwDpj5cDtKkQZQ64

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2008-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2088-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2008-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2088-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2088-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2008-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2088-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2008-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2088-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2008-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2088-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2088 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe

pid process

2008 2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2088	asih.exe

pid	process
2008	2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe

description	pid	process	target process
PID 2008 wrote to memory of 2088	2008	2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe	asih.exe
PID 2008 wrote to memory of 2088	2008	2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe	asih.exe
PID 2008 wrote to memory of 2088	2008	2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe	asih.exe
PID 2008 wrote to memory of 2088	2008	2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_5563e7e8f4902a4785121afe42e171cf_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
bb7e38f6461986c6877d3db1ef499aad

SHA1
7647ffad9b703349402b2e8e38408cff7aa2170f

SHA256
c9769dd260ddf7aece4cef76736fc64d08523e1c097a2d0db88f95bcf85dbd09

SHA512
2f35617212388f638719ef05387899cc58bb639574881edacefae8dc9373581d335d9645fa403d1ca2ee5536a598c6ee72b900b9a33d7b4e6a0d3b514e459c28

Download Submit
memory/2008-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2008-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2008-3-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2008-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2008-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2088-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2088-19-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2088-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2088-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download