9261ebc53eac1c9995ccb5ea25b67f6a55eb9527860842811109e5f0d55e15f0

Analysis

max time kernel
14s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe
Size

31KB
MD5

4a735a82190c82aab5d225cc47dfce15
SHA1

9dc587ebb8c2aa1bd5bf90cd60a82f98c00dbe89
SHA256

9261ebc53eac1c9995ccb5ea25b67f6a55eb9527860842811109e5f0d55e15f0
SHA512

3ea074e0f03548748b6fe344f05a71c2ecd066d55c5ff7a9acc204c051384b955be8cfbfb8bb61837ba3b74cdc7c5692a7a7e40ec5164bfffffa02064e55a805
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zznum+U8Ss87vhL:b/yC4GyNM01GuQMNXum+NSnL

Score

9^/10

discovery

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

2556 retln.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe

pid process

3012 2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exeretln.exe

pid process

3012 2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe
2556 retln.exe

pid	process
2556	retln.exe

pid	process
3012	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe

pid	process
3012	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe
2556	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe

description	pid	process	target process
PID 3012 wrote to memory of 2556	3012	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe	retln.exe
PID 3012 wrote to memory of 2556	3012	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe	retln.exe
PID 3012 wrote to memory of 2556	3012	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe	retln.exe
PID 3012 wrote to memory of 2556	3012	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe	retln.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3012

C:\Users\Admin\AppData\Local\Temp\retln.exe
"C:\Users\Admin\AppData\Local\Temp\retln.exe"
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
31KB

MD5
044302d0f17e3bfd1606c45fc59dd205

SHA1
9fb1958f90560c3803edc94fe79a6afe15262740

SHA256
8c3c07f8fd9d6a92016bf52a8fad1da0da9ca9704ff3d84948d0ab28c1ff41e7

SHA512
67a3b6bbda8f9bc0a702e2fbb5c6a84a073ce64f30d72fcdd1946a5652542552102b6731f86f2416c39f7b72339b67f5ee847ad83c5cc602b58760cb6f258eca

Download Submit
memory/2556-23-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/3012-0-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/3012-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3012-8-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download