210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe
Size

35KB
MD5

aa9698bb26c3a1d8dbb7d3e8f198378e
SHA1

a2623463e3fe065be5408a2bc41adba4a1116dfc
SHA256

210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc
SHA512

fc3f5ca46f71e7681ff22d513a947a191031223ea02a69145e2bbdc75917bbe4b476980e01b2c954b1c9603c5c6da206f3df20c51c2ab9168475863a45d756a9
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4o:fT+hsMQMOtEvwDpjoIHo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000014a94-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000014a94-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2204	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2804	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2204	2804	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe	28
PID 2804 wrote to memory of 2204	2804	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe	28
PID 2804 wrote to memory of 2204	2804	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe	28
PID 2804 wrote to memory of 2204	2804	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe	28

C:\Users\Admin\AppData\Local\Temp\210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe
"C:\Users\Admin\AppData\Local\Temp\210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
36KB

MD5
67b71464b1b7da866fe1072bd8ec33d3

SHA1
8f04e25d90d418b82e9579154786de24b589a9e9

SHA256
62403af3c2210cc2cdc6be2359fcdb2c5dd95fe138dbeaca2a34c895e7516805

SHA512
0aff044a5b57e674935d9cf458f796ef51cafdaaecb4a55316f73ede162e3e805be670ef7023ddef079b000e8033c6e1c3da73153af6afd3e48d528c09cf78b3

Download Submit
memory/2804-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2804-1-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2804-6-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download