cadbbcbc1fc76d366bbfce7eddac3905ea014b3e4fed5ba699a66eca24c45c02

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe
Size

38KB
MD5

6f5e2da571526a4eae467d2ea49aa530
SHA1

e3eaf6ec84e9a19b50b157b2d0c928290b814c8b
SHA256

cadbbcbc1fc76d366bbfce7eddac3905ea014b3e4fed5ba699a66eca24c45c02
SHA512

fa91d2fad00573de6aec0fd81771ccc3b45f0feb4c0c01b7f5d9df7932cdbfcc20496b0e9810bcd8134d7be0d8e30c2ce773b10fa5d436a90a78ba97bb989c6d
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBv:qDdFJy3QMOtEvwDpjjWMl7TdZ

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2700-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2700-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2616-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2700-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2700-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2616-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2700-1-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2700-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2616-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2616 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe

pid process

2700 2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe

pid	process
2616	asih.exe

pid	process
2700	2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2700-1-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/2700-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2616-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe

description	pid	process	target process
PID 2700 wrote to memory of 2616	2700	2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe	asih.exe
PID 2700 wrote to memory of 2616	2700	2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe	asih.exe
PID 2700 wrote to memory of 2616	2700	2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe	asih.exe
PID 2700 wrote to memory of 2616	2700	2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-26_6f5e2da571526a4eae467d2ea49aa530_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2616

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
38KB

MD5
24aa7a45b75cab91b07d732336800840

SHA1
15bc31dd9b02b80a8d14d580a25b17bc54671e00

SHA256
4d227cd7e151c84d0cb061922e1345d0a2a574523f4cce1d1d92bbe2f89b0259

SHA512
5e56fb5914067e5cfb71a5bfd5bc47c5620c4ec26910d1cb5823bf7d6e089e082ec18b1cf469e0bcf225c47b346698850ad632d84b123fc034df0e841dfeef40

Download Submit
memory/2616-26-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2616-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2616-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2700-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2700-1-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2700-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2700-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2700-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download