medusalocker | 6f5fc7c80132e86b697df53ba3d487c6b6342b9eb43e8bc0b02e7957279c15b7

Analysis

max time kernel
134s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 13:32

Target

6f5fc7c80132e86b697df53ba3d487c6b6342b9eb43e8bc0b02e7957279c15b7.exe
Size

543KB
MD5

6b9b54e880f3d75e4c2c128d2f34adb6
SHA1

85385606bdd97a9939a145d100569449a034576e
SHA256

6f5fc7c80132e86b697df53ba3d487c6b6342b9eb43e8bc0b02e7957279c15b7
SHA512

03a1897681d28594a13cdb3c347424ef6e90ab29f11cf8e040ad827fc62dbcccbc61eec6bab203b3a99edb5b2ca1718e8ec5112fabdd979b1ba86754a266cabc
SSDEEP

12288:EirHRTnZ6PTa83j3abCiS6PCMapYW9VxF/MGOP0EpW039S4091ifr:RrZ6PTpjab0cCMapY4x5MGfMW0I448

Score

10^/10

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

MedusaLocker payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/320-3-0x0000000000400000-0x0000000000478000-memory.dmp	family_medusalocker
behavioral2/memory/320-7-0x0000000000400000-0x0000000000478000-memory.dmp	family_medusalocker
behavioral2/memory/320-2-0x0000000000400000-0x0000000000478000-memory.dmp	family_medusalocker

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2884	320	WerFault.exe	6f5fc7c80132e86b697df53ba3d487c6b6342b9eb43e8bc0b02e7957279c15b7.exe
1576	320	WerFault.exe	6f5fc7c80132e86b697df53ba3d487c6b6342b9eb43e8bc0b02e7957279c15b7.exe

C:\Users\Admin\AppData\Local\Temp\6f5fc7c80132e86b697df53ba3d487c6b6342b9eb43e8bc0b02e7957279c15b7.exe
"C:\Users\Admin\AppData\Local\Temp\6f5fc7c80132e86b697df53ba3d487c6b6342b9eb43e8bc0b02e7957279c15b7.exe"
1⤵
PID:320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 572
  2⤵
  - Program crash
  PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 580
  2⤵
  - Program crash
  PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 320 -ip 320
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 320 -ip 320
1⤵
PID:1264

memory/320-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/320-3-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/320-5-0x0000000002110000-0x000000000214F000-memory.dmp

Filesize
252KB

Download
memory/320-7-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/320-6-0x0000000000401000-0x0000000000440000-memory.dmp

Filesize
252KB

Download
memory/320-4-0x00000000004C0000-0x00000000004C2000-memory.dmp

Filesize
8KB

Download
memory/320-2-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/320-1-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/320-9-0x0000000002110000-0x000000000214F000-memory.dmp

Filesize
252KB

Download