447c6c75cdba7082bdd8eb386f5ad6e1bf2c0b0a4bdfca31e411daa647306c9e

General

Target

2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe
Size

78KB
MD5

5c945e904e56c1008ca77d32a5b6e4f4
SHA1

513c9dc7d2e933ca455fbff10476c2555e7a18a2
SHA256

447c6c75cdba7082bdd8eb386f5ad6e1bf2c0b0a4bdfca31e411daa647306c9e
SHA512

69283cb14ff7c9f424f493fc7ca0fa262ad0e6f9983ebe3b4de8bcb5f6ab7c9961b5723249744dfac8cce983bb54bc1dbc6062dcabc4a6aea829db91e734cc79
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdxPUxB1FV:T6a+rdOOtEvwDpjNtHPU

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/1760-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2936-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2936-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/1760-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2936-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2936-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/1760-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2936-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2936-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2936 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe

pid process

1760 2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe

pid	process
2936	asih.exe

pid	process
1760	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1760-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/1760-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2936-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2936-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe

description	pid	process	target process
PID 1760 wrote to memory of 2936	1760	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe	asih.exe
PID 1760 wrote to memory of 2936	1760	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe	asih.exe
PID 1760 wrote to memory of 2936	1760	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe	asih.exe
PID 1760 wrote to memory of 2936	1760	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
78KB

MD5
24f22018fa777634999474a7d4da4ea6

SHA1
93c4e66ff38a590d869c1b1a23b56540fe66eacf

SHA256
c32e9dcb8ef08fbee6d6a04e133ace5759fa1e0dd4355e6ec405195cab9e869d

SHA512
fecaeb44917559da49149c64e5dacb2daf83cbbe71e55be96b89b1011d58dde1e02481506b87a992e2699344d046ea2066820a2bebd7351e77713a8b09535673

Download Submit
memory/1760-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1760-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1760-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1760-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1760-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2936-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2936-18-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2936-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2936-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads