2ef747938e444f4f9a78d18bd11dde62a922abb63929a612a02d6c5eb86897d1

General

Target

2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe
Size

38KB
MD5

e56d1308a325632c3312c92279b6b812
SHA1

8750d1344fb2aaaff8d941792fcb865c8a6fab1b
SHA256

2ef747938e444f4f9a78d18bd11dde62a922abb63929a612a02d6c5eb86897d1
SHA512

fec3770c44fe2db030efb30f57510002fed72c2d45ab543edb4367b5875a84f217b5879a2524a8016577a9c0f4f32709f2535ffb48955d8300512f0f923e6d22
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBsaUC:qDdFJy3QMOtEvwDpjjWMl7TdaC

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2252-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2544-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2252-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2544-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2252-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2544-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2252-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2544-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2252-1-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2544-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2252-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2544-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2544 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe

pid process

2252 2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe

pid	process
2544	asih.exe

pid	process
2252	2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2252-1-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/2544-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2252-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2544-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe

description	pid	process	target process
PID 2252 wrote to memory of 2544	2252	2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe	asih.exe
PID 2252 wrote to memory of 2544	2252	2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe	asih.exe
PID 2252 wrote to memory of 2544	2252	2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe	asih.exe
PID 2252 wrote to memory of 2544	2252	2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_e56d1308a325632c3312c92279b6b812_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
54a5b3fba087158fbc1f815eaf4ba974

SHA1
e89b4f56f68c550b1b9a85a1a1d11e5d8b80e453

SHA256
048a06fdf96536b8fceeb5dc31bace288d0bff21733c61e01b9544e5b9acb738

SHA512
9ca9cc450a864bb62143b61ae154b1ab7b2fbfb6fa2ca8529bc8c066d96172c2bb1fc8bf93052b9b921db03f4aeb7e93d0c8ced49b3a2d21590ac6d4e831802a

Download Submit
memory/2252-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2252-1-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2252-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2252-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2252-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2544-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2544-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2544-26-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2544-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads