26ee2fc319d440c7a3b3803dc2bade68826d9d07982d801304cb51f9d99a7106

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe
Size

47KB
MD5

a59240c4a6ede5cb0251e14ac3f4a974
SHA1

5c374923162fbb6245d44530006ca7534b44e77a
SHA256

26ee2fc319d440c7a3b3803dc2bade68826d9d07982d801304cb51f9d99a7106
SHA512

3540e39cd70d074b55f5c9d1ffcda227faf1e48c81dd8b7b413adaeb266148f52a8f300934fbe18da9dd999f775d8f55ae72ea6666fd0459a8ca32dd64e84c5f
SSDEEP

768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkc+:P6Q0ElP6G+gJQMOtEvwDpjB8WMlf+

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1952-8-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/1952-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2116-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2116-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1952-8-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/1952-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2116-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2116-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2116 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe

pid process

1952 2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2116	asih.exe

pid	process
1952	2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe

description	pid	process	target process
PID 1952 wrote to memory of 2116	1952	2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe	asih.exe
PID 1952 wrote to memory of 2116	1952	2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe	asih.exe
PID 1952 wrote to memory of 2116	1952	2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe	asih.exe
PID 1952 wrote to memory of 2116	1952	2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_a59240c4a6ede5cb0251e14ac3f4a974_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
72defac2d889ec557ace436359072e5c

SHA1
dfb31482fe1914ab7f3689c8f332bcec6ad77dc7

SHA256
c47e36086b079170a2c4b7dedf40e74849e607292d68e5d25bd23228316a3932

SHA512
08a71f7531486898df5e06787f684c6571dd1ede4530331d5a08432ab2dd834d2feff597f1b4f07b2ab2b389a7783c7c785436fb2a64de6c5c6915d83666ef39

Download Submit
memory/1952-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1952-8-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1952-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1952-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1952-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2116-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2116-18-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/2116-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2116-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download