736b19bbfcc6f3f8849c75f88c1362521be0f1139f7d8f4fcb6867db32dcb124

General

Target

2024-04-06_9280193d08ea25eed915396f71609484_cryptolocker.exe
Size

76KB
MD5

9280193d08ea25eed915396f71609484
SHA1

1976b194db97f79486e2bafc2dc4c721f6edda5a
SHA256

736b19bbfcc6f3f8849c75f88c1362521be0f1139f7d8f4fcb6867db32dcb124
SHA512

7ee51a0091c4a222fb00229cae7cb77175b68f277cc4260881900c88c84177c7d4593bc1a05308bf0321f5a97d2a69dfa0f076cd70679d6c1ab213b4decfeda4
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdJcR+:T6a+rdOOtEvwDpjNtX

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c0000000122dd-11.dat	CryptoLocker_rule2
behavioral1/memory/2004-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2912-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2004-13-0x00000000004E0000-0x00000000004F0000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2912-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c0000000122dd-11.dat	CryptoLocker_set1
behavioral1/memory/2004-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2912-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2004-13-0x00000000004E0000-0x00000000004F0000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2912-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000c0000000122dd-11.dat	UPX
behavioral1/memory/2004-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2912-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2004-13-0x00000000004E0000-0x00000000004F0000-memory.dmp	UPX
behavioral1/memory/2912-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2912	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2004	2024-04-06_9280193d08ea25eed915396f71609484_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000c0000000122dd-11.dat	upx
behavioral1/memory/2004-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2912-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2004-13-0x00000000004E0000-0x00000000004F0000-memory.dmp	upx
behavioral1/memory/2912-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2912	2004	2024-04-06_9280193d08ea25eed915396f71609484_cryptolocker.exe	28
PID 2004 wrote to memory of 2912	2004	2024-04-06_9280193d08ea25eed915396f71609484_cryptolocker.exe	28
PID 2004 wrote to memory of 2912	2004	2024-04-06_9280193d08ea25eed915396f71609484_cryptolocker.exe	28
PID 2004 wrote to memory of 2912	2004	2024-04-06_9280193d08ea25eed915396f71609484_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-06_9280193d08ea25eed915396f71609484_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_9280193d08ea25eed915396f71609484_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
76KB

MD5
5691e9b2a4218399f4cfc3ad2d028a66

SHA1
6b940f476de1de3649c3d67760cf859084c8fc8e

SHA256
0474fa0d04f407bba881a5e84275e02d0b58df7b09ab5ed6382bac8fb57f8709

SHA512
7435fa297e6b2824bc459c807b74917e3b3d5423e832eeeb744358c04007ebcfd3aab615e7ad831fc7ce8b944aa8b5f3a6df7608f68e6358f272eed94059d93d

Download Submit
memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2004-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2004-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2004-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2004-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2004-13-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download
memory/2912-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2912-19-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2912-21-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2912-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing