65ed20cd38d0e2fb318e944751c0a19e51a736f0e8eea6cd01e5ad44acd90f88

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_c9e9b500f298141f9340cfb6f466dcb9_cryptolocker.exe
Size

46KB
MD5

c9e9b500f298141f9340cfb6f466dcb9
SHA1

c9786a258348d53828fcb799014d0bf4584dd2cb
SHA256

65ed20cd38d0e2fb318e944751c0a19e51a736f0e8eea6cd01e5ad44acd90f88
SHA512

033d7b2853632c4f9dfc1957fd2256b1bc04302eedb573896eb1a7ce39e651244a1a50cd2d46414e5aa04ee78942e687766ca27e891f240d5b52f63d3a9a6d2f
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2Mobo:qmbhXDmjr5MOtEvwDpj5cDtKkQZQW

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2724-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000900000001222b-11.dat	CryptoLocker_rule2
behavioral1/memory/1616-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2724-14-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1616-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral1/memory/2724-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2724-14-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1616-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2724-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000900000001222b-11.dat	UPX
behavioral1/memory/1616-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2724-14-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/1616-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1616	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2724	2024-04-16_c9e9b500f298141f9340cfb6f466dcb9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 1616	2724	2024-04-16_c9e9b500f298141f9340cfb6f466dcb9_cryptolocker.exe	28
PID 2724 wrote to memory of 1616	2724	2024-04-16_c9e9b500f298141f9340cfb6f466dcb9_cryptolocker.exe	28
PID 2724 wrote to memory of 1616	2724	2024-04-16_c9e9b500f298141f9340cfb6f466dcb9_cryptolocker.exe	28
PID 2724 wrote to memory of 1616	2724	2024-04-16_c9e9b500f298141f9340cfb6f466dcb9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-16_c9e9b500f298141f9340cfb6f466dcb9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_c9e9b500f298141f9340cfb6f466dcb9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
701258c32560bede1c8cd4a0b9e82e98

SHA1
f8b7c59a99e03427423a936875100de5fb9f4531

SHA256
9bc3ae896dcd02a8d83bf292cfe8120579c5612649b895b0bc458126887efd52

SHA512
69ea2ec393850d122e465d1944f78e7814d3db7bfb7cb0dec25f987318627eb3e659732749b9feb615a8c8ece8c165905423b765aede9d95fde089068ec78209

Download Submit
memory/1616-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1616-20-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1616-19-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1616-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2724-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2724-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2724-3-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2724-2-0x0000000001CD0000-0x0000000001CD6000-memory.dmp

Filesize
24KB

Download
memory/2724-15-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/2724-14-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download