7f89ed7a39b2f438b4b7370085c0303872160f6130bd004f6a89a2b49983505f

General

Target

2024-04-20_e75f6360a1eef6ec405567a76124b342_cryptolocker.exe
Size

57KB
MD5

e75f6360a1eef6ec405567a76124b342
SHA1

10ae57b151754017435d2612f8e92a3cc9adad25
SHA256

7f89ed7a39b2f438b4b7370085c0303872160f6130bd004f6a89a2b49983505f
SHA512

7a704b62845304dd8bdb2b7f9ca7ce6305e5b2e5b52b480a36e55bebd3b5e75f2e3619ca43b5e811480069413e4608f16d6b442df98923fe31c69dce1c692cc8
SSDEEP

768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAPO:H6QFElP6n+gou9cvMOtEvwDpjCpVXz

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c00000001224c-11.dat	CryptoLocker_rule2
behavioral1/memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2856-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2856-13-0x00000000021E0000-0x00000000021F0000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2548-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c00000001224c-11.dat	CryptoLocker_set1
behavioral1/memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2856-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2856-13-0x00000000021E0000-0x00000000021F0000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2548-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000c00000001224c-11.dat	UPX
behavioral1/memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2856-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2856-13-0x00000000021E0000-0x00000000021F0000-memory.dmp	UPX
behavioral1/memory/2548-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2548	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2856	2024-04-20_e75f6360a1eef6ec405567a76124b342_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000c00000001224c-11.dat	upx
behavioral1/memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2856-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2856-13-0x00000000021E0000-0x00000000021F0000-memory.dmp	upx
behavioral1/memory/2548-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2548	2856	2024-04-20_e75f6360a1eef6ec405567a76124b342_cryptolocker.exe	28
PID 2856 wrote to memory of 2548	2856	2024-04-20_e75f6360a1eef6ec405567a76124b342_cryptolocker.exe	28
PID 2856 wrote to memory of 2548	2856	2024-04-20_e75f6360a1eef6ec405567a76124b342_cryptolocker.exe	28
PID 2856 wrote to memory of 2548	2856	2024-04-20_e75f6360a1eef6ec405567a76124b342_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-20_e75f6360a1eef6ec405567a76124b342_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-20_e75f6360a1eef6ec405567a76124b342_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
57KB

MD5
4732112450d5e51382b4655f09aecbdf

SHA1
5a8e428769f6d015f524ddc2bca5c56bc4d98199

SHA256
7065a54f99ed57bb740ed8ee5e3c3e9639b1f66d601c583f02ae1e65f2f30acf

SHA512
ad1d749d0b2e838f89c9e783f6b2617f0fec7bf2ee53de06a292e149e5cc6b28de2b381873ae0b847632a107ea3e60c1c97a323376e30e1160844f0b0328de0b

Download Submit
memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2548-19-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2548-22-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2548-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2856-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2856-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2856-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2856-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2856-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2856-13-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing