2c0c57eae20dbafc6b9fa84217cda1d6282da9d1a3517092342ceb6926714cd4

General

Target

2024-04-06_6076dc9fadc6a328fae7e070a82d9e64_cryptolocker.exe
Size

62KB
MD5

6076dc9fadc6a328fae7e070a82d9e64
SHA1

2bd810343883e35901ceff6ccdc1724b9fecca65
SHA256

2c0c57eae20dbafc6b9fa84217cda1d6282da9d1a3517092342ceb6926714cd4
SHA512

aab62d9505a70164f31620c11c2c1eaba5bc8316cd520afa65626073d5e9782e49d5676db310b687e32e947940d0228db06bb8c80f455d19cbeb53867847d3d8
SSDEEP

768:P8mnjO6LsoEEeegiZPvEhHSG+gbum/kLyMro2GtOOtEvwDpjKvWxHCbSVaFn0jKG:P8mnK6QFElP6n+gymddpMOtEvwDpjY8

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012254-11.dat	CryptoLocker_rule2
behavioral1/memory/1964-12-0x0000000001E00000-0x0000000001E10000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/832-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/832-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012254-11.dat	CryptoLocker_set1
behavioral1/memory/1964-12-0x0000000001E00000-0x0000000001E10000-memory.dmp	CryptoLocker_set1
behavioral1/memory/832-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/832-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/files/0x0009000000012254-11.dat	UPX
behavioral1/memory/1964-12-0x0000000001E00000-0x0000000001E10000-memory.dmp	UPX
behavioral1/memory/832-17-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/832-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
832	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	2024-04-06_6076dc9fadc6a328fae7e070a82d9e64_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0009000000012254-11.dat	upx
behavioral1/memory/1964-12-0x0000000001E00000-0x0000000001E10000-memory.dmp	upx
behavioral1/memory/832-17-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/832-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 832	1964	2024-04-06_6076dc9fadc6a328fae7e070a82d9e64_cryptolocker.exe	28
PID 1964 wrote to memory of 832	1964	2024-04-06_6076dc9fadc6a328fae7e070a82d9e64_cryptolocker.exe	28
PID 1964 wrote to memory of 832	1964	2024-04-06_6076dc9fadc6a328fae7e070a82d9e64_cryptolocker.exe	28
PID 1964 wrote to memory of 832	1964	2024-04-06_6076dc9fadc6a328fae7e070a82d9e64_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-06_6076dc9fadc6a328fae7e070a82d9e64_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_6076dc9fadc6a328fae7e070a82d9e64_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
0888ddc120b7ae87068325348da0082a

SHA1
520bcf9f1dec62e68de8baf1f0e8d961ec13198d

SHA256
18b3909990399bfe59e84285f29327f623994a95920c9f422cb2da6771f1604e

SHA512
0c8e77f5fea347cc26a58f0dd3caadaebf60dac2866fe7146c8a0d5ddae1f2d4cf74f2582b4def0fe079a2ac1e24d2b0073470b4c05b3705b8b130a658970a97

Download Submit
memory/832-17-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/832-19-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/832-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1964-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1964-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1964-3-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1964-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1964-12-0x0000000001E00000-0x0000000001E10000-memory.dmp

Filesize
64KB

Download
memory/1964-16-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download

Analysis

Sharing