02a0f24d817083029c7e417400b81df678a7fa7e18b7712bab2e8835683b60aa

General

Target

2024-02-18_2fde95a90fc5007b60a16e2650b12e65_cryptolocker.exe
Size

117KB
MD5

2fde95a90fc5007b60a16e2650b12e65
SHA1

3363412851a8e1e978533f9fc4a5f015e04d8643
SHA256

02a0f24d817083029c7e417400b81df678a7fa7e18b7712bab2e8835683b60aa
SHA512

18e4256ee4abda2eada53912606f3a1cb13275cb0e8ac9f9d1ee98813071476946841d27cc574d0bb0cb55ad9f46687d3473d3f0b10c6d2abbe5873a17465c32
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01b:z6a+CdOOtEvwDpjczJ

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/2572-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012252-11.dat	CryptoLocker_rule2
behavioral1/memory/2572-12-0x0000000002800000-0x0000000002810000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2448-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2572-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2448-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/2572-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012252-11.dat	CryptoLocker_set1
behavioral1/memory/2572-12-0x0000000002800000-0x0000000002810000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2448-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2572-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2448-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/2572-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x0009000000012252-11.dat	UPX
behavioral1/memory/2572-12-0x0000000002800000-0x0000000002810000-memory.dmp	UPX
behavioral1/memory/2448-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2572-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2448-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2448	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2572	2024-02-18_2fde95a90fc5007b60a16e2650b12e65_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2572-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0009000000012252-11.dat	upx
behavioral1/memory/2572-12-0x0000000002800000-0x0000000002810000-memory.dmp	upx
behavioral1/memory/2448-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2572-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2448-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2448	2572	2024-02-18_2fde95a90fc5007b60a16e2650b12e65_cryptolocker.exe	28
PID 2572 wrote to memory of 2448	2572	2024-02-18_2fde95a90fc5007b60a16e2650b12e65_cryptolocker.exe	28
PID 2572 wrote to memory of 2448	2572	2024-02-18_2fde95a90fc5007b60a16e2650b12e65_cryptolocker.exe	28
PID 2572 wrote to memory of 2448	2572	2024-02-18_2fde95a90fc5007b60a16e2650b12e65_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-18_2fde95a90fc5007b60a16e2650b12e65_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_2fde95a90fc5007b60a16e2650b12e65_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
117KB

MD5
9f40d0037f27a37e9992d523f2dde721

SHA1
f2e8e835d6a403cad61c7b31d02adad72620598f

SHA256
e45216532311da4273193f13c9b3053a4d3843e836027cdddc07285f491dca3c

SHA512
5ffac25578eeba45aad1c617e066143e05793de803580c3fab46cdedade1314083f306ead23394a47dc15ae93891f7ed5a8463252623656910c3afe3f6a1a365

Download Submit
memory/2448-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2448-19-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2448-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2572-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2572-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2572-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2572-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2572-12-0x0000000002800000-0x0000000002810000-memory.dmp

Filesize
64KB

Download
memory/2572-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing