32330823d1588e490f8fc0f85e930e3f0a6bc08dcf45405b9e20b795ebc52364

General

Target

2024-03-13_27741c88c83aabf0bde8ef2fb1e83955_cryptolocker.exe
Size

86KB
MD5

27741c88c83aabf0bde8ef2fb1e83955
SHA1

89cf436b35bb501f7162cd592df589fb096af332
SHA256

32330823d1588e490f8fc0f85e930e3f0a6bc08dcf45405b9e20b795ebc52364
SHA512

221e5c02b58637d69d8bfbd2aa1ed195f4e849e54d359a62345df4079f65a81980198701b529533858ee55c8541fc22c842b58be13afd1c476781a5bbbcb4ab3
SSDEEP

768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIEkpqq:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgO

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/2216-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000012241-11.dat	CryptoLocker_rule2
behavioral1/memory/2216-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2120-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2120-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2216-29-0x0000000001FE0000-0x0000000001FEF000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/2216-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b000000012241-11.dat	CryptoLocker_set1
behavioral1/memory/2216-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2120-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2120-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2216-29-0x0000000001FE0000-0x0000000001FEF000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2216-0-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral1/files/0x000b000000012241-11.dat	UPX
behavioral1/memory/2216-15-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral1/memory/2120-18-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral1/memory/2120-27-0x0000000000500000-0x000000000050F000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2120	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	2024-03-13_27741c88c83aabf0bde8ef2fb1e83955_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000b000000012241-11.dat	upx
behavioral1/memory/2216-15-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2120-18-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2120-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2120	2216	2024-03-13_27741c88c83aabf0bde8ef2fb1e83955_cryptolocker.exe	28
PID 2216 wrote to memory of 2120	2216	2024-03-13_27741c88c83aabf0bde8ef2fb1e83955_cryptolocker.exe	28
PID 2216 wrote to memory of 2120	2216	2024-03-13_27741c88c83aabf0bde8ef2fb1e83955_cryptolocker.exe	28
PID 2216 wrote to memory of 2120	2216	2024-03-13_27741c88c83aabf0bde8ef2fb1e83955_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-13_27741c88c83aabf0bde8ef2fb1e83955_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_27741c88c83aabf0bde8ef2fb1e83955_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
87KB

MD5
655d375c8c75dcbc497097a0ec4cfe4d

SHA1
f65960355bf639125df29cf766ba6b94cd1375a0

SHA256
ae1bd93a885966fb6c7225c80e4cf2351e40a68f83c472cf5ef06a24fc9c8dab

SHA512
45f0a5a391225a8ca3a170b3a97bd6e20bb893a57173c83030be0196d02727fa57cc8237aaffd803eacf97bd62289ec9cfae3e372449eda8fe913a834a16f46c

Download Submit
memory/2120-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2120-19-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2120-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2120-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2216-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2216-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2216-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2216-4-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2216-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2216-16-0x0000000001FE0000-0x0000000001FEF000-memory.dmp

Filesize
60KB

Download
memory/2216-29-0x0000000001FE0000-0x0000000001FEF000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing