9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe
Size

82KB
MD5

0dba9f1a07ab9ea4be2f6d17b0055c57
SHA1

8cd6cb7551ed9335eb876a94ee7c99083f4f9cd5
SHA256

9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad
SHA512

94f96cbf320431b5f03c3fccbfdc29f99b978eaeecfc666551837850f9cf3ae092675ba9f6e6a8cf968c43ae1bc972c3cabd375125235d6f8eb1ad7156d66b98
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrCjh:TCjsIOtEvwDpj5HE/OUHnSMw

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1936-8-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000012279-11.dat	CryptoLocker_rule2
behavioral1/memory/2416-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2416-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1936-8-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c000000012279-11.dat	CryptoLocker_set1
behavioral1/memory/2416-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2416-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2416	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1936	9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2416	1936	9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe	28
PID 1936 wrote to memory of 2416	1936	9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe	28
PID 1936 wrote to memory of 2416	1936	9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe	28
PID 1936 wrote to memory of 2416	1936	9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe	28

C:\Users\Admin\AppData\Local\Temp\9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe
"C:\Users\Admin\AppData\Local\Temp\9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
f6857d6048e00f433c4d48f526a39a4e

SHA1
1304ee80f1504e20269dd6a38e5155098927b853

SHA256
48ed00ee2798da54ad5daf299efcca84b03e4f61a19b35ab054bc2143303081d

SHA512
26824175d28f083733067476c0935d2144ec3000662506f77c9add8747285d389cef2185e7021b82c20f7893d0e923f115eaac0e97c6050d2845a9eb5790e49f

Download Submit
memory/1936-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1936-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1936-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1936-8-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2416-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2416-17-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/2416-24-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2416-25-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download