062a2f4fc9713797e628fa231a4295abc75e746c0baabdf480252071bb1b06cf

General

Target

2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
Size

44KB
MD5

074775682094ad4f46674645def17ccb
SHA1

304acb7e0e99837739179b335dd08789447dba33
SHA256

062a2f4fc9713797e628fa231a4295abc75e746c0baabdf480252071bb1b06cf
SHA512

1270d62a972231113993b3323ab82c01326c67dfbd8ab1d086b7ecfcd12f49ce839806ee6323d9f1bd4b328a896b4a93b1217f3b6368a4d221837014dd603641
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAS:b/pYayGig5HjS3NPAS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2316	retln.exe
2316	retln.exe
2316	retln.exe
2316	retln.exe
2316	retln.exe

Loads dropped DLL 5 IoCs

pid	Process
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 10 IoCs

pid	Process
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
2316	retln.exe
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
2316	retln.exe
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
2316	retln.exe
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
2316	retln.exe
1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
2316	retln.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28
PID 1860 wrote to memory of 2316	1860	2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-29_074775682094ad4f46674645def17ccb_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1

T1046

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
45KB

MD5
3bd5b4e35152a9a4dc3b7dbb9128371d

SHA1
e12514aca819153f510709f3f941d4e7c986bd91

SHA256
00875f5ee96c8a920e876d5b1dc70ee23c8c079ef5fbfb6eab2e3ab9e570c710

SHA512
dc751c2a91aad2226e01cf677cc05c691a340d576313d555718d74c786d9453a723fa6e17d30d9dbb625e902280ae1b3e4d1212599d697d06e3d036beb406f3e

Download Submit
memory/1860-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1860-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1860-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1860-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1860-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1860-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1860-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2316-23-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2316-23-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2316-23-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2316-23-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2316-23-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing