a1bf97281a8beae37f5795a42cc735a17fe1602732a8b400eb368e76888c2714

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-10_d1a957a8cbd3ff241d386c04cd650578_cryptolocker.exe
Size

31KB
MD5

d1a957a8cbd3ff241d386c04cd650578
SHA1

5ce9059f41db2258dbda9f207db20a733d8ace14
SHA256

a1bf97281a8beae37f5795a42cc735a17fe1602732a8b400eb368e76888c2714
SHA512

de365547ad9c8b3b43eb6aad121d44443f79c9bc18d71afb272f951739f62a3c19d2b9ec3904492cf29e6b06c913f35ce47d79df6649e7684ec7db5645b8ef69
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3vdy:bAvJCYOOvbRPDEgXRcJk

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022f51-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-06-10_d1a957a8cbd3ff241d386c04cd650578_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
4308	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4308	4072	2024-06-10_d1a957a8cbd3ff241d386c04cd650578_cryptolocker.exe	82
PID 4072 wrote to memory of 4308	4072	2024-06-10_d1a957a8cbd3ff241d386c04cd650578_cryptolocker.exe	82
PID 4072 wrote to memory of 4308	4072	2024-06-10_d1a957a8cbd3ff241d386c04cd650578_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-10_d1a957a8cbd3ff241d386c04cd650578_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-10_d1a957a8cbd3ff241d386c04cd650578_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
31KB

MD5
9d48435713844af108625b47e78853f9

SHA1
073e4a9ad1c353194063e5e459595dbcd9000157

SHA256
5d838fcf941ea36b4eafac865c13c7486a96cef55ba9eb37ec1ea3ea7ef10b7e

SHA512
3b9e393e5b341019ce85b76a740dc86bcffbbd99c7156315ff4b569b7c60c0fc2667a11effa69944fd40ba088851bc24547eeaf4025d83a5a133dd76d5629fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
186B

MD5
5beb7eecb223de471d09c4c760e034b6

SHA1
d3b3198f938b45f51b5cfafdeea406bbdb9d0140

SHA256
ddbf7035910ddfd4e4a329f29db198342f6ca098fcfa3e9354fd60993d0e41c0

SHA512
68774484a7709a5b62b17f6200780d20e5a2e57a0fca706116d5744ced7933ec37a5d32ec1475f620d52b917c4a3431cdd5486d769fec21189c78d974258e4a2

Download Submit
memory/4072-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4072-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4072-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4308-25-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download