cdcdbe0838befc41116a3071f565c0241848d65fa1fffa6054a5e99419387721

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-25_5db604cb24a7de767308cbef3bcf5dd2_cryptolocker.exe
Size

31KB
MD5

5db604cb24a7de767308cbef3bcf5dd2
SHA1

f89f90ca240ba45c67758c105df4a18dd44e2d03
SHA256

cdcdbe0838befc41116a3071f565c0241848d65fa1fffa6054a5e99419387721
SHA512

fe23fe4a2f8018b4327daaefde4e92cb3873090cf7e5752198f1c8d7d52eff72c80cef64c40e14e3f9f4b8636bfda0742e7f6224d42fd68a0a445e2f4de9ef01
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cuM98Fr:bAvJCYOOvbRPDEgXRcuM98Fr

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002324c-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	2024-02-25_5db604cb24a7de767308cbef3bcf5dd2_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
3828	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3828	4992	2024-02-25_5db604cb24a7de767308cbef3bcf5dd2_cryptolocker.exe	85
PID 4992 wrote to memory of 3828	4992	2024-02-25_5db604cb24a7de767308cbef3bcf5dd2_cryptolocker.exe	85
PID 4992 wrote to memory of 3828	4992	2024-02-25_5db604cb24a7de767308cbef3bcf5dd2_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-25_5db604cb24a7de767308cbef3bcf5dd2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-25_5db604cb24a7de767308cbef3bcf5dd2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
32KB

MD5
2ef83c72451c5400835993f63e1c88aa

SHA1
6749e715d7f0c03e4e1f51b719435a4c9d4dbb37

SHA256
fd79552a22b1ab02fa7bb4c7ed7cfe063475a7b70c1544e025ec8284f0fd5a23

SHA512
b69ccc01c4b89347d8f1ee84c778e5890ddc8b3516b6a71b1d340a7d465049e61a4bec766803483c055a0b07d56900e7a34f0b1eb51121674bdfff2689a7db79

Download Submit
memory/3828-20-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/4992-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4992-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4992-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download