Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-03-2024 17:34

General

  • Target

    2024-03-15_5b58a488abdef734b90b879e2ad07c2e_cryptolocker.exe

  • Size

    118KB

  • MD5

    5b58a488abdef734b90b879e2ad07c2e

  • SHA1

    5cf1289832446da7ce85a6dab566a3a92bb3f8e2

  • SHA256

    11f251820ee0bfbab105dea9ebf21c718ecc08f395948e2dc4d90fb5b9a403a4

  • SHA512

    7916f0963faa2aefbe2a3a00bee6e29c2b572c1410a278b4333a67f7ac8ec88e480322deb76f391d199afdb010a244bf0415365aaec7a5c02e0e536dd091ee3b

  • SSDEEP

    1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp01ZNd:z6a+CdOOtEvwDpjczL

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-15_5b58a488abdef734b90b879e2ad07c2e_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-15_5b58a488abdef734b90b879e2ad07c2e_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3016

Network

  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
    Response
    emrlogistics.com
    IN CNAME
    traff-3.hugedomains.com
    traff-3.hugedomains.com
    IN CNAME
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    IN A
    3.18.7.81
    hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com
    IN A
    3.19.116.195
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.18.7.81:443
    emrlogistics.com
    asih.exe
    152 B
    3
  • 3.19.116.195:443
    emrlogistics.com
    asih.exe
    52 B
    1
  • 8.8.8.8:53
    emrlogistics.com
    dns
    asih.exe
    62 B
    192 B
    1
    1

    DNS Request

    emrlogistics.com

    DNS Response

    3.18.7.81
    3.19.116.195

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    118KB

    MD5

    def234ba5f9f8fda9db7a42fc53629ad

    SHA1

    9101a1c2ac50ef5f26da3ac876255e943731a1cd

    SHA256

    835f544e88d880732bdda5842460cff046c7083317c42615b24bab99a0562ec7

    SHA512

    697e27c5b19c4ff66320a85c2bc92af156b06a20166b0bf4c867d67a00bf472dbe369894578743aa1c9f7787885b97b6f01a4204c3087adc3d43352f311ce065

  • memory/2000-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

    Filesize

    24KB

  • memory/2000-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2000-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2000-6-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2000-14-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3016-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3016-18-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/3016-25-0x00000000004A0000-0x00000000004A6000-memory.dmp

    Filesize

    24KB

  • memory/3016-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.