Analysis Overview
SHA256
308e2d9a98066c0789a73be20246262b10d29d5b0859421ede2274af17a57190
Threat Level: Known bad
The file Trojan-Ransom.Win32.GenericCryptor.czx-308e2d9a98066c0789a73be20246262b10d29d5b0859421ede2274af17a57190 was found to be: Known bad.
Malicious Activity Summary
Urelas
Checks computer location settings
ASPack v2.12-2.42
Deletes itself
Executes dropped EXE
Loads dropped DLL
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-02-29 05:38
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-29 05:38
Reported
2024-02-29 05:47
Platform
win7-20240221-en
Max time kernel
200s
Max time network
175s
Command Line
Signatures
Urelas
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\lyfod.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\piotw.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\lyfod.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe"
C:\Users\Admin\AppData\Local\Temp\lyfod.exe
"C:\Users\Admin\AppData\Local\Temp\lyfod.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
C:\Users\Admin\AppData\Local\Temp\piotw.exe
"C:\Users\Admin\AppData\Local\Temp\piotw.exe"
Network
| Country | Destination | Domain | Proto |
| KR | 218.54.31.226:11110 | tcp | |
| KR | 1.234.83.146:11170 | tcp | |
| KR | 218.54.31.165:11110 | tcp | |
| JP | 133.242.129.155:11110 | tcp |
Files
memory/2444-0-0x0000000001010000-0x0000000001092000-memory.dmp
memory/2444-1-0x0000000000140000-0x0000000000141000-memory.dmp
\Users\Admin\AppData\Local\Temp\lyfod.exe
| MD5 | 1b8156b4d4ed55ac8a15b511ad708bb6 |
| SHA1 | e7aa4dc84ef417c156726351da8745b2ba8c670c |
| SHA256 | a46ec81202d475eb22614e8623a4f3282f01beace4db9a6d4f95d63719f80d37 |
| SHA512 | 91d023f06890a9d0cc4d45ebf2184f88ce1eb2fc9215dda59660abf13739d90f203068c3f098e86c24163e1d8290a55121180ae42b58f99743151839f5792bc2 |
memory/2444-7-0x0000000002870000-0x00000000028F2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
| MD5 | c1a0648fe9d4b93ec746a6e41f3f7ca8 |
| SHA1 | 57e04f2693480be87a11398ca938f8183e62db7c |
| SHA256 | 3de16b3be327336ff28d2383af13c7c6f0ae7d3b75884c4dc7a4885f54110e0c |
| SHA512 | 3c4320927f9468c11ef7e3641db0af457a344492873d49262b57d1fd4cc47d1c08f02a959a4e2cb93a6e2f447899501f4fb35da53726ded737f22c906fb4878d |
memory/2892-17-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2444-19-0x0000000001010000-0x0000000001092000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | c84c819b9a1e342f8fba9dd480a7a154 |
| SHA1 | f5e355c1b74dd98eccce1493661b0f8ad8c0a7c7 |
| SHA256 | aa97a1d943d5595194092e7f080891f3e9b27c784162f81b3a6de5ef9005dc8d |
| SHA512 | 810e245418ac4d25fa78a181c4d6e86f04125b2f91b5568685d5779e15d3d269361232b162a2353498062f9fa47b4be86c8971fceb67678cbaf1ccff1f4e7c53 |
memory/2892-22-0x0000000000150000-0x00000000001D2000-memory.dmp
\Users\Admin\AppData\Local\Temp\piotw.exe
| MD5 | 890e693cdde54bbd1e26e5addc821ac0 |
| SHA1 | 2a1711a13c2b24eb40446fe271c6c281d12e5b98 |
| SHA256 | 31dbdaf305907bb1db8431d4f947e6e28c177f96149b63cdb6b6675da71da4d5 |
| SHA512 | 85c3090b91442631291f99606089a19f1453fff7b412980215486ebb3fc4a47c4d5fa014fd428ff0067aae3bab20ceb6f9fe37a984c18c085f6baccba545fb49 |
memory/2096-41-0x00000000003F0000-0x000000000049D000-memory.dmp
memory/2096-42-0x00000000003F0000-0x000000000049D000-memory.dmp
memory/2892-39-0x0000000002FC0000-0x000000000306D000-memory.dmp
memory/2096-38-0x00000000003F0000-0x000000000049D000-memory.dmp
memory/2892-37-0x0000000000150000-0x00000000001D2000-memory.dmp
memory/2096-43-0x00000000003F0000-0x000000000049D000-memory.dmp
memory/2096-45-0x00000000003F0000-0x000000000049D000-memory.dmp
memory/2096-46-0x00000000003F0000-0x000000000049D000-memory.dmp
memory/2096-47-0x00000000003F0000-0x000000000049D000-memory.dmp
memory/2096-48-0x00000000003F0000-0x000000000049D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-02-29 05:38
Reported
2024-02-29 05:45
Platform
win10v2004-20240226-en
Max time kernel
149s
Max time network
126s
Command Line
Signatures
Urelas
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\hekey.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\hekey.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xemed.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe"
C:\Users\Admin\AppData\Local\Temp\hekey.exe
"C:\Users\Admin\AppData\Local\Temp\hekey.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
C:\Users\Admin\AppData\Local\Temp\xemed.exe
"C:\Users\Admin\AppData\Local\Temp\xemed.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.19.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| KR | 218.54.31.226:11110 | tcp | |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| KR | 1.234.83.146:11170 | tcp | |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| KR | 218.54.31.165:11110 | tcp | |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| JP | 133.242.129.155:11110 | tcp | |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
Files
memory/2668-0-0x0000000000140000-0x00000000001C2000-memory.dmp
memory/2668-1-0x00000000009A0000-0x00000000009A1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\hekey.exe
| MD5 | a5c46d21a52c4e0acab53dde87b3c41e |
| SHA1 | 84d373d216eac1919a5037e89bf17b1c2eca9784 |
| SHA256 | 814e69cd594e8d09b6c470ef3bb2a5a202eff7445c4e459b484c2903d453bfb1 |
| SHA512 | 60d952b735db40371b3c41adf6ff21da7735e348e29fe7b02b0094cf40cc0b3ff75837338f6bfbb009a39c70ecb0b82bd48dbd0b9045cedb1e012898e768b7aa |
memory/3608-10-0x0000000000200000-0x0000000000282000-memory.dmp
memory/3608-14-0x0000000001040000-0x0000000001041000-memory.dmp
memory/2668-16-0x0000000000140000-0x00000000001C2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
| MD5 | c1a0648fe9d4b93ec746a6e41f3f7ca8 |
| SHA1 | 57e04f2693480be87a11398ca938f8183e62db7c |
| SHA256 | 3de16b3be327336ff28d2383af13c7c6f0ae7d3b75884c4dc7a4885f54110e0c |
| SHA512 | 3c4320927f9468c11ef7e3641db0af457a344492873d49262b57d1fd4cc47d1c08f02a959a4e2cb93a6e2f447899501f4fb35da53726ded737f22c906fb4878d |
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | cfa173f565973e1e53932ed6fbf85176 |
| SHA1 | 02b4a70ca089a16df9959c75e355abc7f8d69a41 |
| SHA256 | cfdc4de5c83b66e16ca0dd636ab5c97e43e8dad1a7140a7bc30a28736978006c |
| SHA512 | 7c4349ff63e2bb245bd71e6af2b8208fb2660fc0187cc4c711e5825ae406892daca9199469ef72f4e395d16969b0a7cf0e56e2b230854b7fd797f98d11fd5548 |
memory/3608-19-0x0000000000200000-0x0000000000282000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\xemed.exe
| MD5 | 2a7d1dd97b22db38d807bb3a62dfa799 |
| SHA1 | 7406f6f4f5b70614d0ee9ef017b9cdd3e2e1c97a |
| SHA256 | 56620cf71d52d8f474e96c1a4618ff85a75074f76b389e427c807cd6fc585cca |
| SHA512 | 2b3320596b8e227e1a74bb72fe45cd52efc8b1910de0320e786fd2cddebf67386f136ce1490e5c30255a8208b5d3f363e8b77c734e56cd52626829aa4e2eccf0 |
memory/3608-38-0x0000000000200000-0x0000000000282000-memory.dmp
memory/3724-37-0x0000000000D70000-0x0000000000E1D000-memory.dmp
memory/3724-40-0x0000000000D70000-0x0000000000E1D000-memory.dmp
memory/3724-39-0x0000000000D70000-0x0000000000E1D000-memory.dmp
memory/3724-41-0x0000000000D70000-0x0000000000E1D000-memory.dmp
memory/3724-43-0x0000000000D70000-0x0000000000E1D000-memory.dmp
memory/3724-44-0x0000000000D70000-0x0000000000E1D000-memory.dmp
memory/3724-45-0x0000000000D70000-0x0000000000E1D000-memory.dmp
memory/3724-46-0x0000000000D70000-0x0000000000E1D000-memory.dmp
memory/3724-47-0x0000000000D70000-0x0000000000E1D000-memory.dmp