Overview

overview

10

Static

static

10

2024-02-14...er.exe

windows7-x64

9

2024-02-14...er.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    153s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 15:23 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-14_1e982274299411c0acec1ffb63e5ecfa_cryptolocker.exe

  • Size

    49KB

  • MD5

    1e982274299411c0acec1ffb63e5ecfa

  • SHA1

    4699f18d4ee7098039a9861d83f74f89a76b7e54

  • SHA256

    8f36dd7ea73f09b6d6506816553b35a3e2deea0307606dc7faf87e704d6ca3d3

  • SHA512

    923cfce1eb93749f869ba313200d99a36566f2e5c3daede2ac7fcc4b9c5717351b91df6f37fa8a3dd875aef75574ebcd8cb1717150cac24c7317ddf41ebd4f97

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vx1x:X6QFElP6n+gJBMOtEvwDpjBtEx7

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-14_1e982274299411c0acec1ffb63e5ecfa_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-14_1e982274299411c0acec1ffb63e5ecfa_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:708
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3288

Network

  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    202.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    202.178.17.96.in-addr.arpa
    IN PTR
    Response
    202.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-202deploystaticakamaitechnologiescom
  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
    Response
    emrlogistics.com
    IN CNAME
    traff-3.hugedomains.com
    traff-3.hugedomains.com
    IN CNAME
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    IN A
    3.19.116.195
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    IN A
    3.18.7.81
  • flag-us
    DNS
    85.177.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    85.177.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    179.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    179.178.17.96.in-addr.arpa
    IN PTR
    Response
    179.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-179deploystaticakamaitechnologiescom
  • flag-us
    DNS
    29.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    16.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    16.173.189.20.in-addr.arpa
    IN PTR
    Response
  • 52.142.223.178:80
    52 B
     1
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    260 B
     5
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    52 B
     1
  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    202.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    202.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    emrlogistics.com
    dns
    asih.exe
    62 B
     192 B
     1
    1

    DNS Request

    emrlogistics.com

    DNS Response

    3.19.116.195
    3.18.7.81

  • 8.8.8.8:53
    85.177.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    85.177.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    179.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    179.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    29.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    29.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    16.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    16.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe
    Filesize

    49KB

    MD5

    22ce412d9c5e4f3405206e74857c8e21

    SHA1

    9fd64d9700fd8838055cb68b3850b61695fb274b

    SHA256

    86741fd5f829861ace6bf1620404ec2a68e4832e4dddb11d75c7e38590840752

    SHA512

    e1696e79818eb871505261cb05a372f03ed6a07e6e427399148bf9a5b9eb5007c3ff5c718afd681bfef6578298c763baaebd82d92a583f5cbca8c1b11e0e6f99

    Download Submit

  • memory/708-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/708-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/708-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3288-17-0x0000000002000000-0x0000000002006000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3288-23-0x0000000001FE0000-0x0000000001FE6000-memory.dmp

    Filesize

    24KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.