9a2438d410efe83ec06adff1622ea492ea8c798978c0511836f083e4e4c3199d

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe
Size

43KB
MD5

d351ba21100ae33d68689928b5a1aee2
SHA1

855e218f8acca1f6ee5946a99058e7b2778046d2
SHA256

9a2438d410efe83ec06adff1622ea492ea8c798978c0511836f083e4e4c3199d
SHA512

3b7b3bdbab7105f23b6cfc2a515464bdf5c2d14eb1bdd1e40150731a715de9d083c17e72a28cbee51100427c670bf189abb90d5521cc9bc64bd2c3cdf50f96e8
SSDEEP

768:bQyC4GyNM01GuQMNXwXOQ69zbjlAAX5e9zY:bQpYayGiAizbR9XwzY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000122ec-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2888	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
3068	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3068	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe
2888	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2888	3068	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe	28
PID 3068 wrote to memory of 2888	3068	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe	28
PID 3068 wrote to memory of 2888	3068	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe	28
PID 3068 wrote to memory of 2888	3068	2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-14_d351ba21100ae33d68689928b5a1aee2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
43KB

MD5
687db79d9ca7bf0cacbca4d22a240b9c

SHA1
62b452a50263c86dd6b44c2633d9804af0eeeca7

SHA256
bccc1be0cd2cfe3c8c42b1c2ba4f41db13270897ab10c2cea20e3c6cdedb02c0

SHA512
b02362e57764acc74810a63c6f9cb6a75e92317180c37e303ae33b868d274b6cbde71c07dc13555eaf34d1cdef5c2585d2e45c38592dde0f8bc52b17600f7b53

Download Submit
memory/2888-16-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/3068-0-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/3068-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3068-8-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download