d2e51b85cef9136f7e95fbc96e758b6f2ede5c9edb054250bf9a7c8e7e610121

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:23

Target

20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe
Size

38KB
MD5

b0c36e3dc472cc5c0106ef5414cf941e
SHA1

3b626dbdb9953e696957dd6ab8c9d2690b859355
SHA256

d2e51b85cef9136f7e95fbc96e758b6f2ede5c9edb054250bf9a7c8e7e610121
SHA512

b075f9cfa3b25eb84376bc1f5ecc98c1109280b7340075ad5be5a239be8d249e6a1829c941a17f44d854b1bf9b56cddaa04d7ac8eb0802d1863a08683812508a
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/EIjxuaPt:b/yC4GyNM01GuQMNXw2PSjH+PPxVt

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

2236 retln.exe
Loads dropped DLL 1 IoCs

Processes:

20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe

pid process

1152 20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exeretln.exe

pid process

1152 20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe
2236 retln.exe

pid	process
2236	retln.exe

pid	process
1152	20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe

pid	process
1152	20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe
2236	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe

description	pid	process	target process
PID 1152 wrote to memory of 2236	1152	20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe	retln.exe
PID 1152 wrote to memory of 2236	1152	20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe	retln.exe
PID 1152 wrote to memory of 2236	1152	20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe	retln.exe
PID 1152 wrote to memory of 2236	1152	20240521b0c36e3dc472cc5c0106ef5414cf941ecryptolocker.exe	retln.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
38KB

MD5
8f787074d7322105866f647da80121e2

SHA1
addacd9ce4fd767e3e3a16000e3c2510965af369

SHA256
c7e31a1b6f497bf15dcc7975aa25538ae96884c8aae0424a4439843535056c01

SHA512
c171cbd1ee8bc1947802aa8e43f5e0fce74d205572e20ccd7bcf30cb7642c2525fad6df705d53c2e3a9866f1e96d4f8571bd4f71bd59b0e0c04b64ad72eca3a9

Download Submit
memory/1152-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1152-8-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/1152-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2236-23-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download