dc042340b1c850c49cacebc387774c504c1be63f60dde9a90dd40ac3a88a006b

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe
Size

74KB
MD5

3f42449df2220bce36da5e4b383eda66
SHA1

d5f6dec22bbde8b3dcb32ae3ca6e0a259747cb63
SHA256

dc042340b1c850c49cacebc387774c504c1be63f60dde9a90dd40ac3a88a006b
SHA512

7c1f64149d6ffafe7878d906c3c5ed9ad4d7a80367794e272cac8eecb393d3101d7a776d46b8cb64bbad40dff9b053b2941752ea79675e1877b2c2ee7cf93bd4
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsaleFY:1nK6a+qdOOtEvwDpj6

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2628	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2404	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0009000000012254-11.dat	upx
behavioral1/memory/2628-17-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2404-15-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2628-27-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2628	2404	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe	28
PID 2404 wrote to memory of 2628	2404	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe	28
PID 2404 wrote to memory of 2628	2404	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe	28
PID 2404 wrote to memory of 2628	2404	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
2a2df536d94fe9b87ead86f5a6c29523

SHA1
6a131122f9fbfacde8c460835d2829b0543fa5ce

SHA256
4f66c7bd6110a1e8c9e2e92721b426b57d48211e3614815f3ee6c21acaa82e1b

SHA512
803c7a100178344b39349138dd4a8b9e5b160583bb49704c9631b10d09ef31f299983b92523c8c71ad3026bb300dfed9f547f1c3a11e402f508af45e9f41730a

Download Submit
memory/2404-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2404-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2404-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2404-4-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2404-15-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2404-14-0x0000000002800000-0x0000000002810000-memory.dmp

Filesize
64KB

Download
memory/2628-17-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2628-20-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2628-19-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2628-27-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download