9261ebc53eac1c9995ccb5ea25b67f6a55eb9527860842811109e5f0d55e15f0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe
Size

31KB
MD5

4a735a82190c82aab5d225cc47dfce15
SHA1

9dc587ebb8c2aa1bd5bf90cd60a82f98c00dbe89
SHA256

9261ebc53eac1c9995ccb5ea25b67f6a55eb9527860842811109e5f0d55e15f0
SHA512

3ea074e0f03548748b6fe344f05a71c2ecd066d55c5ff7a9acc204c051384b955be8cfbfb8bb61837ba3b74cdc7c5692a7a7e40ec5164bfffffa02064e55a805
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zznum+U8Ss87vhL:b/yC4GyNM01GuQMNXum+NSnL

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

4616 retln.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4616	retln.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe

description	pid	process	target process
PID 3948 wrote to memory of 4616	3948	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe	retln.exe
PID 3948 wrote to memory of 4616	3948	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe	retln.exe
PID 3948 wrote to memory of 4616	3948	2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe	retln.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_4a735a82190c82aab5d225cc47dfce15_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3948

C:\Users\Admin\AppData\Local\Temp\retln.exe
"C:\Users\Admin\AppData\Local\Temp\retln.exe"
2⤵
- Executes dropped EXE
PID:4616

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe
Filesize
31KB

MD5
044302d0f17e3bfd1606c45fc59dd205

SHA1
9fb1958f90560c3803edc94fe79a6afe15262740

SHA256
8c3c07f8fd9d6a92016bf52a8fad1da0da9ca9704ff3d84948d0ab28c1ff41e7

SHA512
67a3b6bbda8f9bc0a702e2fbb5c6a84a073ce64f30d72fcdd1946a5652542552102b6731f86f2416c39f7b72339b67f5ee847ad83c5cc602b58760cb6f258eca

Download Submit
memory/3948-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3948-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3948-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download