Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
17/02/2024, 19:46 UTC
General
-
Target
2024-02-17_efd8665c40d6a46e2a93b1e67fa9ed61_cryptolocker.exe
-
Size
88KB
-
MD5
efd8665c40d6a46e2a93b1e67fa9ed61
-
SHA1
253dc199ceec1cb400928dfaf379dc84ff85609a
-
SHA256
99ca22f4cc833f785c425efde045514f4b70586641a80650304db2eafc81ffb0
-
SHA512
e43e3c5b66c1cf6df1c96910ed906412c08e34ec75494cb5669783da1129bf053dbc8c5c25162f4905d373b7807737939f94d1f46a35272a72c3590e51944ffb
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgLZ:AnBdOOtEvwDpj6zh
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_efd8665c40d6a46e2a93b1e67fa9ed61_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_efd8665c40d6a46e2a93b1e67fa9ed61_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
-
DNSemrlogistics.comRemote address:8.8.8.8:53Requestemrlogistics.comIN AResponseemrlogistics.comIN CNAMEtraff-5.hugedomains.comtraff-5.hugedomains.comIN CNAMEhdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.comhdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.comIN A34.205.242.146hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.comIN A54.161.222.85
-
34.205.242.146:443emrlogistics.com
-
54.161.222.85:443emrlogistics.com
-
34.205.242.146:443emrlogistics.com
-
54.161.222.85:443emrlogistics.com
-
34.205.242.146:443emrlogistics.com
-
54.161.222.85:443emrlogistics.com
-
34.205.242.146:443emrlogistics.com
-
54.161.222.85:443emrlogistics.com
-
8.8.8.8:53emrlogistics.comdns
DNS Request
emrlogistics.com
DNS Response
34.205.242.14654.161.222.85
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD53c657765ee8a7bbd6900bf1b616f2221
SHA13438d991fff5a17b0b57ddef454ea256a070d68c
SHA2569e4ba842049e10e380766098ef0e593e54fb189255710633c6b504642641357f
SHA512c12ea13f0371c099d139c9ae68d64bdf5d5c280b09fae33b25ba6eb55ab34e76d9406ac8e299fcebae8ae47df63104f48995f79b35765b60fa863fcacb2b0e06
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB