Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-09-2024 12:15

General

  • Target

    2024-09-05_cc8ab811ebe24660d626af1ebebe10e1_cryptolocker.exe

  • Size

    64KB

  • MD5

    cc8ab811ebe24660d626af1ebebe10e1

  • SHA1

    587a81506cd8efa158b21a0c5f43e1fa34a24aaa

  • SHA256

    0397cfb91b7a9e201d0c8cef1ad9afc86c1c7a4b7c2a9995f926e86d329cba82

  • SHA512

    6e0a94b6a23885daf6aee92005ab30fb603110ad3d4ca696cdcdc8033a8cc65e1520fa78945f38155971eceaa2c96b15c9f85ea73188b200985fbd8106fa1a77

  • SSDEEP

    1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLZ/xblzopx0:X6a+SOtEvwDpjBrO1

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-05_cc8ab811ebe24660d626af1ebebe10e1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-05_cc8ab811ebe24660d626af1ebebe10e1_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:632

Network

  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    emrlogistics.com
    asih.exe
    Remote address:
    8.8.8.8:53
    Request
    emrlogistics.com
    IN A
    Response
    emrlogistics.com
    IN CNAME
    traff-5.hugedomains.com
    traff-5.hugedomains.com
    IN CNAME
    hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com
    hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com
    IN A
    54.161.222.85
    hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com
    IN A
    34.205.242.146
  • flag-us
    DNS
    73.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 54.161.222.85:443
    emrlogistics.com
    asih.exe
    260 B
    5
  • 34.205.242.146:443
    emrlogistics.com
    asih.exe
    260 B
    5
  • 54.161.222.85:443
    emrlogistics.com
    asih.exe
    260 B
    5
  • 34.205.242.146:443
    emrlogistics.com
    asih.exe
    260 B
    5
  • 54.161.222.85:443
    emrlogistics.com
    asih.exe
    260 B
    5
  • 34.205.242.146:443
    emrlogistics.com
    asih.exe
    260 B
    5
  • 54.161.222.85:443
    emrlogistics.com
    asih.exe
    260 B
    5
  • 34.205.242.146:443
    emrlogistics.com
    asih.exe
    52 B
    1
  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    emrlogistics.com
    dns
    asih.exe
    62 B
    192 B
    1
    1

    DNS Request

    emrlogistics.com

    DNS Response

    54.161.222.85
    34.205.242.146

  • 8.8.8.8:53
    73.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    73.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    64KB

    MD5

    81c56a2a725260d62dd9a5d2dabc71b4

    SHA1

    a46dd7142f1e27eb72adb3c84e3233d64e61b03f

    SHA256

    d85592c551879cdd9db2f8b4f358a39482d46949bf2738995d7d397465a4702e

    SHA512

    f15e91ec8cfd53cce22f814a9333a070c9bf7c27ec99001884a80f9a97676c120741bb039248903000b677852df9636b62c4d2e32d230b34a83965f847d50a3b

  • memory/632-18-0x0000000002100000-0x0000000002106000-memory.dmp

    Filesize

    24KB

  • memory/632-17-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/4764-0-0x0000000000730000-0x0000000000736000-memory.dmp

    Filesize

    24KB

  • memory/4764-1-0x0000000000730000-0x0000000000736000-memory.dmp

    Filesize

    24KB

  • memory/4764-2-0x0000000000750000-0x0000000000756000-memory.dmp

    Filesize

    24KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.