9ec77706c37a23411898a9d4807fbf61b4f6d8adf87d4ceb026f606e76f39fd2

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe
Size

36KB
MD5

1e2b09c997fae6a117077bce68eb6e44
SHA1

8775e9046e9698bf8bf1c729dd0b436f07f1c3d4
SHA256

9ec77706c37a23411898a9d4807fbf61b4f6d8adf87d4ceb026f606e76f39fd2
SHA512

ee4b0cf37e14132204328d20d4bf7d5c54649514f6cbc9a11d26493bad00cb5c3e022285ea53275f231b8675ff87251c5eb59571a4859cdc2886f16a54ed7763
SSDEEP

768:bAvJCYOOvbRPDEgXrNekd7l94i3pQheDF:bAvJCF+RQgJeab4sb5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000015cb1-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2536	demka.exe

Loads dropped DLL 1 IoCs

pid	Process
1992	2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1992	2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe
2536	demka.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2536	1992	2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe	28
PID 1992 wrote to memory of 2536	1992	2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe	28
PID 1992 wrote to memory of 2536	1992	2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe	28
PID 1992 wrote to memory of 2536	1992	2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-09_1e2b09c997fae6a117077bce68eb6e44_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
37KB

MD5
b25af0c79afee75590c38416ce74060b

SHA1
ebfd64232fe9f246fcb4ef7611b32bdc5db1e92d

SHA256
02268a432b46c5fc29608fb5e782ed30c4deb842a472f4b6c193b5c5a409fd2d

SHA512
6c660a50badf9fa45424da3db07ff319f8cd00d97518549b6a8671d4cd88c828249c2d70f181453e09ea3f5ef882ae72c9a58c9e73cb899cfa1602176a4fd496

Download Submit
memory/1992-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/1992-1-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/1992-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download