e26e6180e9c02225453ea5cd27fdf41c39af1326eb05df5eb73e926405627888

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-05_85f9aa20315d40d0438a779d96958f57_cryptolocker.exe
Size

32KB
MD5

85f9aa20315d40d0438a779d96958f57
SHA1

5e91f8fdb5e56d79ef5fb33b7ffc62d710973e02
SHA256

e26e6180e9c02225453ea5cd27fdf41c39af1326eb05df5eb73e926405627888
SHA512

f928f385ff4b2de2bcfcad29d17ab7ac15a2b787888be87d4e3935a9308090e8551ccfcd501ec3b4a702775b9fe860e492c85607fe12d0543bbd502b26f8f2ac
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzo6cJ3vdow:bAvJCYOOvbRPDEgXRcJV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	2024-09-05_85f9aa20315d40d0438a779d96958f57_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	demka.exe

Executes dropped EXE 1 IoCs

pid	Process
2932	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-05_85f9aa20315d40d0438a779d96958f57_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	demka.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2932	2676	2024-09-05_85f9aa20315d40d0438a779d96958f57_cryptolocker.exe	85
PID 2676 wrote to memory of 2932	2676	2024-09-05_85f9aa20315d40d0438a779d96958f57_cryptolocker.exe	85
PID 2676 wrote to memory of 2932	2676	2024-09-05_85f9aa20315d40d0438a779d96958f57_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-09-05_85f9aa20315d40d0438a779d96958f57_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-05_85f9aa20315d40d0438a779d96958f57_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
32KB

MD5
b29eae9af49437022fd7a12bf1b759a5

SHA1
27d11630291642469f77f927800b49ee2e2575ab

SHA256
87dc4d8a23dd1204cf329e450c6aa0a413167b69654575d599477cd521687b4f

SHA512
3236be4a9d22e25cf26f4d026393222bdc1e7735e58ad3ad497e5e9424d8d24c813862369282c288674657806363275578803d2472f214bd9c55aee60ca3ebc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\medkem.exe

Filesize
185B

MD5
aecec204f88a596764a5e15efa89e154

SHA1
365ca829f06d9c574b7c9f007e0e8b81e7df7662

SHA256
d07864ce9d274464f5c36847f6315bd86bc93a547aa8d902163e7382b3fb741f

SHA512
7a141ac4bb8e55259a6d6d75fa28111a574a10b593e7cb4dd0a704595c3d4f30e630cd59ea62756a970faed6de3b446020bb4ccc9515451ec59f5d5c0e5e96d0

Download Submit
memory/2676-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/2676-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/2676-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2932-25-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download