a0b970652acd83599702e83428ea1b75ccffdd51aac1b1613138ff05d6c20b0d

General

Target

2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe
Size

91KB
MD5

86471c74a1506060dc6af6221aa5dc04
SHA1

6d5bf91eb1b6847bb091cb056acfe1513ce9606d
SHA256

a0b970652acd83599702e83428ea1b75ccffdd51aac1b1613138ff05d6c20b0d
SHA512

10bc54d8ba1823428ba6aff6cd74e59e87927018c3bbfdd562f3c25946eb5544648e43d302bc230ca5b18d910fd4cb10f5a4cfa7777cba7a52a5bec46801bdd8
SSDEEP

1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAA/Dx:n6a+1SEOtEvwDpjYYvQd2P2

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1776-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1776-12-0x00000000006D0000-0x00000000006E0000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/1776-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1704-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1776-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1776-12-0x00000000006D0000-0x00000000006E0000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/1776-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1704-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1776-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/1776-12-0x00000000006D0000-0x00000000006E0000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/1776-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/1704-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

1704 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe

pid process

1776 2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe

pid	process
1704	asih.exe

pid	process
1776	2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1776-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1776-12-0x00000000006D0000-0x00000000006E0000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/1776-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1704-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe

description	pid	process	target process
PID 1776 wrote to memory of 1704	1776	2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe	asih.exe
PID 1776 wrote to memory of 1704	1776	2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe	asih.exe
PID 1776 wrote to memory of 1704	1776	2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe	asih.exe
PID 1776 wrote to memory of 1704	1776	2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_86471c74a1506060dc6af6221aa5dc04_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
91KB

MD5
192795b6db52dcec79f730d0a908decb

SHA1
1b102b07e2328e6d1987968c0c3954c84b2154b8

SHA256
f166632f7778511f237edd4de1c46d9f0cdd3b0ebca83aa3df3d0c9851bfcd39

SHA512
7ef07876476a4f2da15c66cba15724ab35957a60b90657aa1e55d51fe0600c6953b60101e4777ca037fb4ff23aadec19c279b945a5c92aa548d0a3b963378b16

Download Submit
memory/1704-25-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1704-18-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1704-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1776-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1776-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1776-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1776-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1776-12-0x00000000006D0000-0x00000000006E0000-memory.dmp

Filesize
64KB

Download
memory/1776-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads