c421c1605c9516285d2a69fcd29065a33697620e2ad6120f5405ed3d52c2deeb

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-31_4e18d89b70f9b0c1061bd32abe74ff1c_cryptolocker.exe
Size

43KB
MD5

4e18d89b70f9b0c1061bd32abe74ff1c
SHA1

258e00cc0b7c6d44d4297024677debc40aa6ee6a
SHA256

c421c1605c9516285d2a69fcd29065a33697620e2ad6120f5405ed3d52c2deeb
SHA512

72c9e11ffc138afd98f240e2afd514a8ca1e73556c0920a0451c37e3bd81394579a3c72942bd96da59817c48df80fb660c25c178d374d8dd2182bc91fab042b5
SSDEEP

768:bAvJCYOOvbRPDEgXrNekd7l94i3py/yY/JiJ:bAvJCF+RQgJeab4sy/loJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023266-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	2024-05-31_4e18d89b70f9b0c1061bd32abe74ff1c_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4044	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4044	3308	2024-05-31_4e18d89b70f9b0c1061bd32abe74ff1c_cryptolocker.exe	82
PID 3308 wrote to memory of 4044	3308	2024-05-31_4e18d89b70f9b0c1061bd32abe74ff1c_cryptolocker.exe	82
PID 3308 wrote to memory of 4044	3308	2024-05-31_4e18d89b70f9b0c1061bd32abe74ff1c_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-31_4e18d89b70f9b0c1061bd32abe74ff1c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_4e18d89b70f9b0c1061bd32abe74ff1c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
43KB

MD5
3f8450eef73c5f9264194e3edcedf2b5

SHA1
e6967272767c3f9783deb9198a60aefd52c0d7e1

SHA256
c0eec53aec2603ac798bab5afce278403dd40f9bf5c4fe7d9b62facb83e8a10d

SHA512
68330dc632f9b6b0219c3524a77affc9c9a997355d0fdb9bfc16c70438efff5bd143cd30dc8403f3f92103b526a21f0609f9dae509f8d93abb72147cb2277663

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
46cfe45443be21fe5028f453e54ad1a7

SHA1
5b0e89c5a5042b69a65da0b69474ed98031520ee

SHA256
236a7a3b17aa203492c8143f827b4ebd6b2e7cff0c89bfe73e0fdca5684ca5a3

SHA512
9732c232af74ae0a6c96e05dfeb0e065a820cda89ba21e8fc70bdbcfa352e72201f09f59af2b3135cab48a30a831880f8ba200c5e408a68e0492c5c27ce3069a

Download Submit
memory/3308-0-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/3308-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3308-8-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4044-25-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download