Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 14:17
Static task
static1
Behavioral task
behavioral1
Sample
4be825ffefde03c6614e5799f7e489084e03620eb383f91624a7d24f63adfa36.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4be825ffefde03c6614e5799f7e489084e03620eb383f91624a7d24f63adfa36.exe
Resource
win10v2004-20240426-en
General
-
Target
4be825ffefde03c6614e5799f7e489084e03620eb383f91624a7d24f63adfa36.exe
-
Size
535KB
-
MD5
d17dcd3b8f0bd0ae5eee86b39c4232c5
-
SHA1
8d9ed7444aabf5df4e4066c707358e03c9a38cf8
-
SHA256
4be825ffefde03c6614e5799f7e489084e03620eb383f91624a7d24f63adfa36
-
SHA512
e5bba3470615b5f854209ce8d7fbea534cc6092d7f1ed1eef32c570aeef118467e1dd1772e8a8cab4507c7088fe4ca798d086189464f51086e05255e87fce22f
-
SSDEEP
12288:z/JPISLQOyNXK9ayXmhUcVbbwKylMV+rGLvbOHxGz:z78fN6YrbtbJHVsG1z
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2132-2-0x0000000000400000-0x0000000000476000-memory.dmp family_medusalocker behavioral1/memory/2132-7-0x0000000000400000-0x0000000000476000-memory.dmp family_medusalocker behavioral1/memory/2132-9-0x0000000000400000-0x0000000000476000-memory.dmp family_medusalocker behavioral1/memory/2132-3-0x0000000000400000-0x0000000000476000-memory.dmp family_medusalocker