5737522f9e0641491b13e21409f8b292a9bf091dfd4a133a8de663789d539751

General

Target

2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe
Size

52KB
MD5

58e14fa6a4bc5e1abc416863352b3109
SHA1

8ede4fc8dab57627ebd6e3f31daea0e52cadbc19
SHA256

5737522f9e0641491b13e21409f8b292a9bf091dfd4a133a8de663789d539751
SHA512

189bbc80ec019003fe5abe8c9e63b2b5a982b7cd91fd7c7a4446b2ba85cdab86e9459165051b3d1d667eaad28e3e3b032c07fad874bbac69ae4bc46a5276c57c
SSDEEP

768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOeVf:z6QFElP6n+gKmddpMOtEvwDpj31iet

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2316-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2316-12-0x0000000001ED0000-0x0000000001EE0000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2316-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3048-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2316-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2316-12-0x0000000001ED0000-0x0000000001EE0000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2316-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3048-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2316-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2316-12-0x0000000001ED0000-0x0000000001EE0000-memory.dmp	UPX
behavioral1/memory/2316-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/3048-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3048 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe

pid process

2316 2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe

pid	process
3048	asih.exe

pid	process
2316	2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2316-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/2316-12-0x0000000001ED0000-0x0000000001EE0000-memory.dmp	upx
behavioral1/memory/2316-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3048-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe

description	pid	process	target process
PID 2316 wrote to memory of 3048	2316	2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe	asih.exe
PID 2316 wrote to memory of 3048	2316	2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe	asih.exe
PID 2316 wrote to memory of 3048	2316	2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe	asih.exe
PID 2316 wrote to memory of 3048	2316	2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_58e14fa6a4bc5e1abc416863352b3109_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
0769d98543e4a9625cfd38ec1c804dca

SHA1
81613f5f0ed8b032ea9cd1209d377cb8bcaea6d3

SHA256
e3a983fdba9da204f8352b0256fdfd68f9a380c768ad3a764f87f8561f5c5caa

SHA512
8e80dbc6519b6432606dc2daacbe9d11d7580920164d2b12e470790ab92b2a254cd4bd8bf9d6b2242154afa1d9400690a2f7638f447d38af993401fb72d14429

Download Submit
memory/2316-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2316-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2316-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2316-9-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2316-12-0x0000000001ED0000-0x0000000001EE0000-memory.dmp

Filesize
64KB

Download
memory/2316-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3048-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3048-18-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/3048-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads