Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:17
Behavioral task
behavioral1
Sample
de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe
Resource
win10v2004-20240508-en
General
-
Target
de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe
-
Size
40KB
-
MD5
69b0e140655d4b7b9f1567076bc7f377
-
SHA1
a95b0245821e0631dd2e011a16ef82b79d219f2b
-
SHA256
de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a
-
SHA512
787c8f023578309a1f6d27bb7b0d4a646962f99c552e9998ddc19ec1d6cbb15c756b9b2abf932e21766f455db260debb3b16c853e25825f49acbe20066a0d33e
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYoX:qDdFJy3QMOtEvwDpjjWMl7TlX
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 behavioral1/memory/1800-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1804-18-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1804-27-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_set1 behavioral1/memory/1800-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/1804-18-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/1804-27-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX \Users\Admin\AppData\Local\Temp\asih.exe UPX behavioral1/memory/1800-16-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/1804-18-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/1804-27-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 1804 asih.exe -
Loads dropped DLL 1 IoCs
Processes:
de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exepid process 1800 de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe -
Processes:
resource yara_rule behavioral1/memory/1800-0-0x0000000000500000-0x0000000000510000-memory.dmp upx \Users\Admin\AppData\Local\Temp\asih.exe upx behavioral1/memory/1800-16-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1804-18-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1804-27-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exedescription pid process target process PID 1800 wrote to memory of 1804 1800 de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe asih.exe PID 1800 wrote to memory of 1804 1800 de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe asih.exe PID 1800 wrote to memory of 1804 1800 de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe asih.exe PID 1800 wrote to memory of 1804 1800 de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe"C:\Users\Admin\AppData\Local\Temp\de97a661c9f5f1adf8a5037413942891a03d3f1ab17f1061cd5f9c11cff6233a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\asih.exeFilesize
40KB
MD55c845383623d46e7b0ca323b9fbd945f
SHA169ee3ec29cfe6afd8d49c42c14060129e4042bb5
SHA2564af586076c79c97a9650d9789cd5b4b1e06c43c070670d796e3b1f859d23cd93
SHA51287288655892f09b9f99a3c88b7ad885ea000e2d88c8e27c52b806bfc6e9ec5f28e2a1b63c3c97fb36109958979f94564c364258c6efdbdd74b1ea652369a1e77
-
memory/1800-0-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/1800-2-0x0000000000310000-0x0000000000316000-memory.dmpFilesize
24KB
-
memory/1800-9-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/1800-1-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/1800-16-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/1804-18-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/1804-19-0x0000000000890000-0x0000000000896000-memory.dmpFilesize
24KB
-
memory/1804-26-0x00000000004D0000-0x00000000004D6000-memory.dmpFilesize
24KB
-
memory/1804-27-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB