c8263671117011d833a39a90a63cd5ef509e877478008e69da865d0b58ff21be

Analysis

max time kernel
8s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe
Size

44KB
MD5

8d998af340dfa56aeb428f9924729a46
SHA1

4e0645f2c380dd14b9aad804436e5f504f2fc74e
SHA256

c8263671117011d833a39a90a63cd5ef509e877478008e69da865d0b58ff21be
SHA512

14d1e0c7c3d5f615c71ed3f3e1b45dcde725cf33edefaae88e5056cacf0411eb8b87de32dacc2f4a225b9e4e536f92b021175981cfdce51a7b0926e17d4037a1
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAu:b/pYayGig5HjS3NPAu

Score

9^/10

discovery

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

1704 retln.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe

pid process

2412 2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exeretln.exe

pid process

2412 2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe
1704 retln.exe

pid	process
1704	retln.exe

pid	process
2412	2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe

pid	process
2412	2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe
1704	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe

description	pid	process	target process
PID 2412 wrote to memory of 1704	2412	2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe	retln.exe
PID 2412 wrote to memory of 1704	2412	2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe	retln.exe
PID 2412 wrote to memory of 1704	2412	2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe	retln.exe
PID 2412 wrote to memory of 1704	2412	2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe	retln.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_8d998af340dfa56aeb428f9924729a46_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
44KB

MD5
35916c54f4f148f4a3e9c41490663777

SHA1
52070ac277e328be5640ea0ef726a064db01400b

SHA256
aae3bd2804600861db6ad801904394d58efac703d8af78f72647d61048de016d

SHA512
1bd6703bec77575c74c550273470d60f9a67aa58507927dfc08fb2b0eaef5fd65f44fa843f623f26cd8bd47602cc72c258da4236ed6e979533eeb336e55ea793

Download Submit
memory/1704-23-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2412-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2412-8-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2412-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download