Analysis Overview
SHA256
14a0a102689c1893cb28d471edb8d023e1e58aa11fdd320fb494e8c13fa6234e
Threat Level: Known bad
The file 2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker was found to be: Known bad.
Malicious Activity Summary
Detection of Cryptolocker Samples
Detection of CryptoLocker Variants
Detection of CryptoLocker Variants
Detection of Cryptolocker Samples
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Enumerates physical storage devices
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-01 20:07
Signatures
Detection of CryptoLocker Variants
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Detection of Cryptolocker Samples
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-01 20:07
Reported
2024-06-01 20:10
Platform
win7-20240221-en
Max time kernel
151s
Max time network
156s
Command Line
Signatures
Detection of CryptoLocker Variants
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Detection of Cryptolocker Samples
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\hurok.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | N/A |
Enumerates physical storage devices
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\hurok.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1760 wrote to memory of 2564 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\hurok.exe |
| PID 1760 wrote to memory of 2564 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\hurok.exe |
| PID 1760 wrote to memory of 2564 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\hurok.exe |
| PID 1760 wrote to memory of 2564 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\hurok.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe"
C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gemlttwi.com | udp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 192.185.35.56:443 | tcp |
Files
memory/1760-0-0x0000000000310000-0x0000000000316000-memory.dmp
memory/1760-8-0x0000000000310000-0x0000000000316000-memory.dmp
memory/1760-1-0x0000000000400000-0x0000000000406000-memory.dmp
\Users\Admin\AppData\Local\Temp\hurok.exe
| MD5 | 34e2293ef12943b559b723aa0fa19d77 |
| SHA1 | c39a59b2ccbbd1655e9db063f37967ad57cae554 |
| SHA256 | f2f60217bc371986a84449af00b142a4bd55d0605912183c1c1a63116a0a0948 |
| SHA512 | 18d69b5be029a90a613d2dcdcd52ba57ea664fc3e816022633ff5949f4a8b4bce14905fcc729296e7e114951f0d6f354a927e87dbf8d719d55c05f96e673c55c |
memory/2564-23-0x00000000001C0000-0x00000000001C6000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-01 20:07
Reported
2024-06-01 20:10
Platform
win10v2004-20240426-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
Detection of CryptoLocker Variants
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Detection of Cryptolocker Samples
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\hurok.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\hurok.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4968 wrote to memory of 4052 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\hurok.exe |
| PID 4968 wrote to memory of 4052 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\hurok.exe |
| PID 4968 wrote to memory of 4052 | N/A | C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe | C:\Users\Admin\AppData\Local\Temp\hurok.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_89c54fa571ecb947b8467172770711ea_cryptolocker.exe"
C:\Users\Admin\AppData\Local\Temp\hurok.exe
"C:\Users\Admin\AppData\Local\Temp\hurok.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gemlttwi.com | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 192.185.35.56:443 | gemlttwi.com | tcp |
| US | 8.8.8.8:53 | 56.35.185.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.24.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.97.55.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 177.101.63.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.211.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.201.50.20.in-addr.arpa | udp |
Files
memory/4968-0-0x0000000002040000-0x0000000002046000-memory.dmp
memory/4968-1-0x0000000000400000-0x0000000000406000-memory.dmp
memory/4968-8-0x0000000002040000-0x0000000002046000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\hurok.exe
| MD5 | 34e2293ef12943b559b723aa0fa19d77 |
| SHA1 | c39a59b2ccbbd1655e9db063f37967ad57cae554 |
| SHA256 | f2f60217bc371986a84449af00b142a4bd55d0605912183c1c1a63116a0a0948 |
| SHA512 | 18d69b5be029a90a613d2dcdcd52ba57ea664fc3e816022633ff5949f4a8b4bce14905fcc729296e7e114951f0d6f354a927e87dbf8d719d55c05f96e673c55c |
memory/4052-25-0x0000000000480000-0x0000000000486000-memory.dmp