f25523b3f7261ef35718b112e582347596511496c35589cd7b5366b91cedb032

Analysis

max time kernel
8s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe
Size

33KB
MD5

b9011def94d00b3700b830daaea33881
SHA1

20a1d3d00c5cf9fc4d6495dc7468b714b1fd93a9
SHA256

f25523b3f7261ef35718b112e582347596511496c35589cd7b5366b91cedb032
SHA512

5314fa9ef2ccfd588773e52482b38f247b7c87bc17d80b94711262bb8f69e79820c8afb3858c52cfe45defaef535ca53d7d9df393aafbdef38bd2cf21498c3b3
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznStEkcs826:b/yC4GyNM01GuQMNXw2PSjSKkc9l

Score

9^/10

discovery

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

1300 retln.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe

pid process

1096 2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exeretln.exe

pid process

1096 2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe
1300 retln.exe

pid	process
1300	retln.exe

pid	process
1096	2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe

pid	process
1096	2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe
1300	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe

description	pid	process	target process
PID 1096 wrote to memory of 1300	1096	2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe	retln.exe
PID 1096 wrote to memory of 1300	1096	2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe	retln.exe
PID 1096 wrote to memory of 1300	1096	2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe	retln.exe
PID 1096 wrote to memory of 1300	1096	2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe	retln.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_b9011def94d00b3700b830daaea33881_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
33KB

MD5
078e7e51f02446a040aee3f5fdbc344b

SHA1
e7c5cf72afc38d05f6708c80a788067f99af9a3d

SHA256
c789b1008fd85f115787b0066e5572750ed87607151982ff2bc36fb208eef503

SHA512
a978549b503a48e1c85dba7e4d4d99421042c36bc546c50ff2ead6351182b98e1b02fbeb813d2c4ec0a5d8bd3fa0daa59cf6bcc30e801d17a568f972687f3ca0

Download Submit
memory/1096-0-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1096-8-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1096-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1300-23-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download