95a011e93de3e00c1c66dd6133999d86bba88d2ff06e9cafbaafe26fa8d22f18

General

Target

2024-06-04_e77983105e11d79d2c1ba999377cd63e_cryptolocker.exe
Size

41KB
MD5

e77983105e11d79d2c1ba999377cd63e
SHA1

9daa6b1427aae3d3410fa62b8e44c37e60004dfc
SHA256

95a011e93de3e00c1c66dd6133999d86bba88d2ff06e9cafbaafe26fa8d22f18
SHA512

b30fe2218669d792a8a0939174e37aaaafa11e1b4dad8aca815f2de3d3236b1b3cf4da29f2b57dc65398d75f808ee5ba36965ad8ab5037fa1d9ef59080668e36
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaB0gUS:qDdFJy3QMOtEvwDpjjWMl7TdCgUS

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a000000012286-11.dat	CryptoLocker_rule2
behavioral1/memory/1640-12-0x00000000004F0000-0x0000000000500000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1640-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2696-19-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2696-28-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000a000000012286-11.dat	CryptoLocker_set1
behavioral1/memory/1640-12-0x00000000004F0000-0x0000000000500000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1640-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2696-19-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2696-28-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000a000000012286-11.dat	UPX
behavioral1/memory/1640-12-0x00000000004F0000-0x0000000000500000-memory.dmp	UPX
behavioral1/memory/1640-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2696-19-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2696-28-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2696	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1640	2024-06-04_e77983105e11d79d2c1ba999377cd63e_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000a000000012286-11.dat	upx
behavioral1/memory/1640-12-0x00000000004F0000-0x0000000000500000-memory.dmp	upx
behavioral1/memory/1640-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2696-19-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2696-28-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2696	1640	2024-06-04_e77983105e11d79d2c1ba999377cd63e_cryptolocker.exe	28
PID 1640 wrote to memory of 2696	1640	2024-06-04_e77983105e11d79d2c1ba999377cd63e_cryptolocker.exe	28
PID 1640 wrote to memory of 2696	1640	2024-06-04_e77983105e11d79d2c1ba999377cd63e_cryptolocker.exe	28
PID 1640 wrote to memory of 2696	1640	2024-06-04_e77983105e11d79d2c1ba999377cd63e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-04_e77983105e11d79d2c1ba999377cd63e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-04_e77983105e11d79d2c1ba999377cd63e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
52b0497f9815c436cccce981bc495e1c

SHA1
0bb61a4c88b663e5191697166ac31204a946e2d2

SHA256
4ed5e861f2a327a427c4e5516fe1df7c90b0c8d92b2f245761dd35280a1d1eba

SHA512
11c42bebc6b0fcad134a93fdd4b044ad4fb4512a60e21d3f809333353bfb9ff3b05d56ac7c66eaef85039185ba170de61e1d4f813498e82a0a27580e23f7167d

Download Submit
memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1640-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1640-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1640-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1640-12-0x00000000004F0000-0x0000000000500000-memory.dmp

Filesize
64KB

Download
memory/1640-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2696-19-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2696-27-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2696-20-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2696-28-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing