c2bba54f2efb21c8f7c09c5fae40503f0ffef036edd3c1fa4dc079cb62244dd6

General

Target

2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe
Size

39KB
MD5

75bbc3860fad5a5baea6b5081055013c
SHA1

7f8633e7f87219b0c1324c0c57deabc8deb96749
SHA256

c2bba54f2efb21c8f7c09c5fae40503f0ffef036edd3c1fa4dc079cb62244dd6
SHA512

aa402c230c2a4d808b7497374979b51c1c4acc5a13aa3bdc2936d6d489a2b493c60372bcc70a0a8bd803e02fc0945aad48c8a1d4d121d6be8dc3154cbcf2e859
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaYpy:qDdFJy3QMOtEvwDpjjWMl7TdYpy

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2004-13-0x0000000000420000-0x0000000000430000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2004-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2976-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2976-28-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2004-13-0x0000000000420000-0x0000000000430000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2004-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2976-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2976-28-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2004-13-0x0000000000420000-0x0000000000430000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2004-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2976-18-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2976-28-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2976 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe

pid process

2004 2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe

pid	process
2976	asih.exe

pid	process
2004	2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/2004-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2976-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2976-28-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe

description	pid	process	target process
PID 2004 wrote to memory of 2976	2004	2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe	asih.exe
PID 2004 wrote to memory of 2976	2004	2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe	asih.exe
PID 2004 wrote to memory of 2976	2004	2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe	asih.exe
PID 2004 wrote to memory of 2976	2004	2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_75bbc3860fad5a5baea6b5081055013c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
766ef30a64aacd0c3d00da269fc54e06

SHA1
5b6e169c6e2477d99e3353c3c1b8db4df2ff6e73

SHA256
61d5af80e20aaff1added06f0a65fb6902cbb9961be895a3bff68ae560610794

SHA512
59455602ed87730144ddfa1955ea390eb2e9771bafc7bcac31ed1c43c9d9fbb76e7dc0e9087d08774fe44307c57630159f73d543abb2180d87b26bc03d9a445f

Download Submit
memory/2004-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2004-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2004-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2004-9-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2004-13-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/2004-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2976-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2976-20-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2976-27-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2976-28-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads