Malware Analysis Report

2024-11-15 05:26

Sample ID 240613-by72wszanb
Target 2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker
SHA256 c0ab0c81c984f3d055a49450dfb69795cf355d9c506b057684762edce6cedff5
Tags
discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c0ab0c81c984f3d055a49450dfb69795cf355d9c506b057684762edce6cedff5

Threat Level: Known bad

The file 2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker was found to be: Known bad.

Malicious Activity Summary

discovery

Detection of CryptoLocker Variants

Detection of CryptoLocker Variants

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Creates a large amount of network flows

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 01:34

Signatures

Detection of CryptoLocker Variants

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 01:34

Reported

2024-06-13 01:36

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker.exe"

Signatures

Detection of CryptoLocker Variants

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\retln.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker.exe"

C:\Users\Admin\AppData\Local\Temp\retln.exe

"C:\Users\Admin\AppData\Local\Temp\retln.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 storage-cabinets.info udp
US 8.8.8.8:53 udp

Files

memory/1632-0-0x0000000002160000-0x0000000002166000-memory.dmp

memory/1632-1-0x0000000000400000-0x0000000000406000-memory.dmp

memory/1632-8-0x0000000002160000-0x0000000002166000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\retln.exe

MD5 ad386d25d5d3ef8ac1c2ae8b1229147d
SHA1 1491e833db77f74e4f042242926a6b94bb36f0e4
SHA256 5f580e70c799d7dd57953bd5f2948b300a6eacc0b708ccc30209229fe6657fba
SHA512 ceb2665d60a7a4dfce9cf982bd57f9bba272f121313a581aa9b1489455c0da2455a13bb9dbb7f67c747951c4156f6e8fec8424abcb104f14f6629883884b7235

memory/3508-25-0x0000000002120000-0x0000000002126000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 01:34

Reported

2024-06-13 01:36

Platform

win7-20240221-en

Max time kernel

18s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker.exe"

Signatures

Detection of CryptoLocker Variants

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\retln.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker.exe N/A

Creates a large amount of network flows

discovery

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-13_6991f83afc6547f2597e8c3cea0d0e4e_cryptolocker.exe"

C:\Users\Admin\AppData\Local\Temp\retln.exe

"C:\Users\Admin\AppData\Local\Temp\retln.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 storage-cabinets.info udp

Files

memory/2084-0-0x00000000003C0000-0x00000000003C6000-memory.dmp

memory/2084-1-0x0000000000400000-0x0000000000406000-memory.dmp

memory/2084-8-0x00000000003C0000-0x00000000003C6000-memory.dmp

\Users\Admin\AppData\Local\Temp\retln.exe

MD5 ad386d25d5d3ef8ac1c2ae8b1229147d
SHA1 1491e833db77f74e4f042242926a6b94bb36f0e4
SHA256 5f580e70c799d7dd57953bd5f2948b300a6eacc0b708ccc30209229fe6657fba
SHA512 ceb2665d60a7a4dfce9cf982bd57f9bba272f121313a581aa9b1489455c0da2455a13bb9dbb7f67c747951c4156f6e8fec8424abcb104f14f6629883884b7235

memory/2108-23-0x0000000000290000-0x0000000000296000-memory.dmp