3dce54502388516e310049e5608294a3350de07a4461f6caaa1fa2651a274cf7

Analysis

max time kernel
155s
max time network
168s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_de74b8b3b8874f2119c1d8da903e99b5_cryptolocker.exe
Size

45KB
MD5

de74b8b3b8874f2119c1d8da903e99b5
SHA1

fa759b0b2a50fd27ea5f03a8d3dfa480fadb3287
SHA256

3dce54502388516e310049e5608294a3350de07a4461f6caaa1fa2651a274cf7
SHA512

cdf803e42f482acc0c38ef674178922c8f582cc79dbcabbad21668ab353e2453a8816d6ee46f5b111cc4e2974758c416f4ab387345d4e53c52042fd0a179c174
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedmhXSWl:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+4

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d0000000122ce-11.dat	CryptoLocker_rule2
behavioral1/memory/1148-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2028-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d0000000122ce-11.dat	CryptoLocker_set1
behavioral1/memory/1148-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2028-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1148	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2028	2024-03-15_de74b8b3b8874f2119c1d8da903e99b5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1148	2028	2024-03-15_de74b8b3b8874f2119c1d8da903e99b5_cryptolocker.exe	28
PID 2028 wrote to memory of 1148	2028	2024-03-15_de74b8b3b8874f2119c1d8da903e99b5_cryptolocker.exe	28
PID 2028 wrote to memory of 1148	2028	2024-03-15_de74b8b3b8874f2119c1d8da903e99b5_cryptolocker.exe	28
PID 2028 wrote to memory of 1148	2028	2024-03-15_de74b8b3b8874f2119c1d8da903e99b5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-15_de74b8b3b8874f2119c1d8da903e99b5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_de74b8b3b8874f2119c1d8da903e99b5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
d08fb0dca6f7917992089d5d16fe0a44

SHA1
b2637eb5676469440e2ea3e60afb04b0a16b6c4c

SHA256
10b64cacf90b891079c4fb25100e0a3ecce540229ca5440c20c91388f72e5b35

SHA512
ec2d92c4b3a6f73a05d5426c9270791e708d3b727dd5969c79efce238edbf9a076b3a635ba0311202772d50ae6500f8c8fd710261e73f3e74374c96d8b2e2383

Download Submit
memory/1148-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1148-18-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/1148-21-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2028-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2028-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2028-3-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2028-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2028-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download